Va Cyber Security Research Paper

During SDLC phase one, the initiation phase, “the need for a system is expressed and the purpose of the system is documented” (NIST, 2008). Some of the expected outcomes from this phase would be a project plan and schedule; system performance specifications outlining the operational requirements, system design documents, and a document that defines roles and responsibilities. The corresponding RMF step, security categorization, establishes the foundation for security standardization among information systems and provides a vital step towards integrating security into the information system (NIST, 2008). During this step, the type(s) of information processed by the information system are identified and the information system is categorized to determine the level of protection requirements to put in place. Some of the expected outputs of this step include a security project plan and schedule, documented system boundary, the system categorization, and the security roles and responsibilities. These two process steps are very similar except the focus of RMF is on information security related functions. In some cases, SDLC produces the expected outputs that RMF requires, and the security professionals only require a copy of the documentation for their records. For example, the system design document often depicts the system boundary. The reason this step is so critical is that it

| “Security controls are the management, operational, and technical safeguards or countermeasures employed within an organizational information system to protect the confidentiality, integrity, and availability of the system and its information” (NIST SP 800, 2009). The control allows the organization to efficiently mitigate the risk coming from the use of information System (IS) to conduct business operations and processes.

There is a mess of servers, switches, switches, and inward equipment firewalls. Each of the association's areas is working with diverse data advances and foundation IT frameworks, provisions, and databases. Different levels of IT security and access administration have been actualized and inserted inside their individual areas. The data engineering framework is maturing and numerous areas are running on antiquated fittings and programming. Additionally, the framework is woefully out-of-dated regarding fixes and overhauls which significantly expand the danger to the arrange as far as classifiedness, trustworthiness, and accessibility.

Unit 2 Assignment 1: Executive Summary on Veteran’s Affairs (VA) and Loss of Private Information

Technical controls involves the use of technology and expertise to mitigate risk. An administrator who installs and configures a firewall and IDS to prevent attacks on the network is implementing a technical security control. Management controls use planning and assessment ways to reduce risk. Conducing risk assessment, vulnerability assessment and penetration testing. Lastly. Operational controls are implement by people. Having awareness training and having a contingency plan is a way of implementing operation controls (Darril

IS3350 Unit 2 Assignment 1: Executive Summary on Veteran’s Affairs (VA) and Loss of Private Information

p. 10). Other controls include: Asset Classification and Control maintains an appropriate level of protection for all critical or sensitive assets. Communications and Operations Management reduces the risk of failure and its consequences by ensuring the proper and secure use of information processing facilities and by developing incident response procedures. Systems Development and Maintenance prevents the loss, modification, or misuse of information in operating systems and application software. Business Continuity Management develops the organization’s capacity to react rapidly to the interruption of critical activities resulting from failures, incidents, natural disasters, or catastrophes. Compliance ensures that all laws and regulations

Another step involves security checks upon implementation and describes agency-level threat to the business scenario or the mission. It similarly entails sanctioning the information system for processing and lastly constant monitoring of the security controls. FISMA and NIST's standards are aimed at offering the ways for agencies to achieve their identified missions with safety commensurate with the threat (United States Department of Agriculture, 2015). Together with guidelines from the Office of Management and Budget (OMB), FISMA and NIST create a framework for advancing and growing an information security scheme (SecureIT, 2008). Such framework includes control descriptions and evaluation, program development, and system certification and accreditation. The final objective involves conducting daily functioning of the agency and achieving the agency's articulated objectives with sufficient security commensurate with risk.

The VA has been warned before about their lack of concern toward information security of our personal data, but it went unheard, since nothing serious had happen before, that we knew of. As with all breaches, many go unreported, and someone, somewhere along the lines knew about it, but lets it slide until it is too late, and somebody personal information stolen.

Table of Contents Veterans Administration (VA) Background 2 Veterans Administration Problems 3 High Level Solution 4 Benefits of Solving the Problem 5 Business Process Changes 6 Technology practices used to Augment the Solution 7 Conclusions and Overall Recommendations 8 Summary of Project 9 References 10   The Veterans Administration (VA) is U.S Government Cabinet position set up to serve those who have borne this country battles. Below I have listed their Mission Statement and Core Values. Mission Statement: To fulfill President Lincoln's promise “To care for him who shall have borne the battle, and for his widow, and his orphan” by serving and honoring the men and women who are America’s Veterans. Core Values: VA’s five core values underscore the obligations inherent in VA’s mission: Integrity, Commitment, Advocacy, Respect, and

The framework of security policy is defined to construct a structure by the help of which policy gaps can be identified in an easy manner. A system specific policy would assist to ensure that all employees and management comply with the policies. This is also used to maintain the confidentiality for user authentication would assist in the confidentiality aspect of security, maintain integrity (There are several limiting rules or constraints which are distinct in the relational data model and whose work is to maintain the data’s accuracy and maintain its integrity.), availability and authenticity of the system. Access controls are a collection of mechanisms that work together to create security architecture to protect the assets of an information system. One of the goals of access control is personal accountability, which is the mechanism that proves someone performed a computer activity at a specific point in time. So, the framework acts as the guideline

Security requirements also apply to all VA or contractor-operated services and information resources located and operated at contract facilities, at other government agencies that support VA mission

With large-scale information leaks and system hacks of major companies and industry titans being more heavily covered by the media and drawing public scrutiny, emphasis has been placed on the need for tighter digital and physical security. Some organizations, such as Virginia Tech, have turned to stricter requirements on password protection or dual-authentication in order to provide more security. As the standards for password and item based security, such as Identification Cards or personal phone acceptance, have become more advanced, so to have the systems and techniques of hackers attempting to tamper or steal that information. Virginia Tech has always strived to be a shining beacon for technological advancement and it is this that leads us to believe that it is time to follow the global trend of adopting more secure Biometric scanning systems in order to properly secure sensitive information and physical access across campus.

In today’s world technology has evolved to the point where a large amount of information is stored in cyberspace. It is because of this type of storage people around the world have an easier time at accessing information than ever before. The time before the late 20th century gathering information was long and tedious to get a book that the library did not own would take at least a couple of weeks depending on the time period or it may not have been possible to obtain that book. But now people can access a vast amount of information in a matter of minutes. Example, in modern times if someone wanted to know about a different culture they could simple look up the information on a computer or any device that had access to

The Merriam-Webster’s Dictionary defines cyber security measures taken to protect a computer or computer system (as on the Internet) against unauthorized access or attack Most people think that hackers are just people that want to mess up your computer, but real hackers break into systems because they want to see what they can do, then they might leave a message on the victims computer, but that’s it. So, the computer security people protect from those other hackers that want to mess up peoples computers. The means we take can as individual to protect ourselves in the cyber world is be anyomous on websites, don’t post your personal information ,have virus protection install on your computer, get spy