The Heartbleed Bug. Introduction:. The Heartbleed Bug Was

Recognize the dangers to an association's application security and distinguish the security systems which we can use to secure a domain.

Heartbleed is a security bug named after the Heartbeat request that is used for communication between computers. This bug was present in OpenSSL that is used in implementation of Transport Layer Security (TLS). It was first noticed in 2012 and was confirmed in 2014. This was registered under Common Vulnerability Exposure (CVE) databases as CVE-2014-0160. This was also known as “buffer over read vulnerability”, condition in which more data is being exposed than required. Heartbleed patch was released on April 7, 2014 and on that day only Heartbleed was disclosed publicly.

Another step involves security checks upon implementation and describes agency-level threat to the business scenario or the mission. It similarly entails sanctioning the information system for processing and lastly constant monitoring of the security controls. FISMA and NIST's standards are aimed at offering the ways for agencies to achieve their identified missions with safety commensurate with the threat (United States Department of Agriculture, 2015). Together with guidelines from the Office of Management and Budget (OMB), FISMA and NIST create a framework for advancing and growing an information security scheme (SecureIT, 2008). Such framework includes control descriptions and evaluation, program development, and system certification and accreditation. The final objective involves conducting daily functioning of the agency and achieving the agency's articulated objectives with sufficient security commensurate with risk.

Risk assessment and threat assessment should go hand-in-hand.The outcome of the risk assessment and threat assessment should provide recommendations that maximize the protection of confidentiality, integrity and availability while still providing functionality and usability. The purpose of a risk assessment is to ensure sensitive data and valuable assets are protected. An organization should take a hard look at who has access to sensitive data and if those accesses are required. The security audit should monitor the companies systems and users to detect illicit activity.The security audit should

Data security; affinion security center augments data breach solution. (2012). Information Technology Newsweekly, , 91. Retrieved from http://search.proquest.com/docview/926634711?accountid=458

The purpose of this paper is to review State of Maryland information security program documentation and to determine the security standards used to create the program in order to protect confidentiality, integrity and availability of agency operations, organizational assets or individuals which is the main agenda of State of Maryland Department of information technology. We will also discuss about other standards that can be useful for the State of Maryland Information technology and compare and contrast the standards.

As such, our company’s people resources pose the greatest risk for security breach. Our way to help mitigate risk in this area is to keep communication lines open in this area and to continually mandate security knowledge training, with mandatory updates on a regular basis. When the employees are informed of company policy when facing a security matter, they are better equipped to act in the best or right way. In this way knowledge is power – or at least empowerment to act in the best interest of the company’s information security.

Due to the lack in data security elements, the following recommendations are suggested: strategy and risk assessment. Overall data security begins with the identification of risks and the strategy on the solution to those risks. This can be accomplished through a Strength Opportunities, and Threats (SWOT) analysis. Strengths and weaknesses are derived from internal factors, such as employees, while opportunities and threats are derived from external factors, such as hackers (Value Based Management, 2011).

Confidentiality must be met in the storage, processing, and transmission of data in an organization. For example, we are going to look at a major recent data breach. On March 8, 2017, the US department of homeland security sent Equifax and notice to patch a vulnerability in versions of the Apache Struts software. On March 9, Equifax dispersed the information to applicable personnel. Although told to apply the patch, Equifax security team did not find

Heartbleed leaves you with very small forensic evidence, therefore it's quite difficult to know if any information has been compromised. Heartbleed vulnerability has been in existence for two years but was only discovered in 2014. To eliminated or mitigated the vulnerability that caused by those bugs you should ensure that you conduct a comprehensive scan of your systems and that all vulnerabilities are fixed as soon as possible. You should also ensure all the users to change their username and password. There are different patches are available online for Shellshock some are functional but some are incomplete. Linux distribution Red hat and Ubuntu already has patches and more will appear soon.

The heartbleed wasn’t a virus, but was actually a coding bug in OpenSSL, a cryptographic library for general use. The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by certain versions of the OpenSSL software. This allowed people to steal personal information and eavesdrop on conversations.

Most normal issues confronted by the alliance have extended PC and Information Systems, business layouts are an outcome of the security blasts. Government foundations and affiliations are not kept from such data security dangers. The current condition as most convention affiliations are joined with media and long range interpersonal correspondence closes the rehash of modernized systems on government alliance Information Systems had augmented. As condition of connection is to commission identified with people when in doubt, the mechanized assaults on the association data framework could be considered as dividing security hazard to protection of open data. State and government business areas build up several strategies identified with such propelled strikes; regardless, there is going up against bother in social undertaking necessities considering the rate at which modernized ambushes are developing. For instance, as demonstrated by the survey drove by US - CERT (United States PC crisis reaction pack) it was seen that the measure of mechanized assault scenes has stretched out from 29000 to 48000 (give or take) some spot around 2009 and 2012(USGAO, 2013). It got to be troublesome for the orgs to make fitting gameplans to avoid progressed ambushes as the amplify sort of mechanized assaults have significantly broadened.

Most normal issues confronted by the alliance have extended PC and Information Systems, business layouts are an outcome of the security blasts. Government foundations and affiliations are not kept from such data security dangers. The current condition as most convention affiliations are joined with media and long range interpersonal correspondence closes the rehash of modernized systems on government alliance Information Systems had augmented. As condition of connection is to commission identified with people when in doubt, the mechanized assaults on the association data framework could be considered as dividing security hazard to protection of open data. State and government business areas build up several strategies identified with such propelled strikes; regardless, there is going up against bother in social undertaking necessities considering the rate at which modernized ambushes are developing. For instance, as demonstrated by the survey drove by US - CERT (United States PC crisis reaction pack) it was seen that the measure of mechanized assault scenes has stretched out from 29000 to 48000 (give or take) some spot around 2009 and 2012(USGAO, 2013). It got to be troublesome for the orgs to make fitting gameplans to avoid progressed ambushes as the amplify sort of mechanized assaults have significantly broadened.

The guiding security principles in the scenario are geared to protect its assets. The of its assets are information and data. The CIA triad of Confidentiality, Integrity and Availability which is the pinnacle of information security must always be considered when protecting these invaluable assets.

Answer: Information Security is the practice of defending (guiding) information by considering the CIA Triad Principles which are Confidentiality (Authorize access), Integrity (Accuracy and Completeness) and Availability.