Vulnerability Assessment Matrix & Policy Recommendations Memo This assignment is

Question

Vulnerability Assessment Matrix & Policy Recommendations Memo This assignment is based upon a vulnerability assessment and mitigation methodology developed by the RAND Corporation. Before you begin, make sure that you have read Chapters 2, 3, and 4, of Finding and fixing Vulnerabilities in Information Systems: The Vulnerability Assessment and Mitigation Methodology by Philip Anton (RAND MR1601). The objective of this assignment is to perform a threats and vulnerabilities analysis based upon the process methodology presented in RAND MR1601. The purpose of the analysis process is to help you determine the requirements for an Infrastructure Protection Policy. The results of your analysis will be used in the second part of this assignment to develop policy recommendations which you will then use to write a policy recommendations memorandum for the senior leadership of the organization (see Scenario). To document your analysis, you will complete the assessment matrix shown in Table 4.1 Matrix of Vulnerability Attributes and System Object Types found in Chapter 4 of the RAND document. For each type of threat or vulnerability listed in the assessment matrix, you are required to provide a brief, concise description (a few words or a key phrase) and a recommendation for one or more actions (including implementation of specific security controls) which should be taken to correct or remediate the problem. A sample of a completed matrix, documenting portions of a threats and vulnerabilities assessment, is found in table 4.2 (RAND MR1601). After completing your assessment matrix, you will write a policy recommendation memo which includes 10 to 15 policy statements that can be used to implement your recommendations (as documented in your table). Your memorandum should begin with a brief introduction to the policy issue being addressed (see Scenario). Your recommendations should cover the broad spectrum of actions which will address the threats and vulnerabilities discussed in your analysis. From your recommendations, it should be clear that you performed the following actions: • Identified threats and vulnerabilities (risk identification) • Assigned security controls to protect the enterprise infrastructure (risk management) • Incorporated capabilities for future detection of threats, vulnerabilities, and attacks • Formalized incident response as a business process (policies, plans, procedures) • Formalized disaster recovery and business continuity policies, plans, procedures Each policy statement should be phrased in the form of a shall statement which specifies the actions that must be taken to implement your recommendations. For example, DoDI 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN), includes the following shall statements: • Risk to the trust in applicable systems shall be managed throughout the entire system lifecycle. • The identification of mission critical functions and critical components as well as TSN planning and implementation activities, including risk acceptance as appropriate, shall be documented in … • Risk management shall include TSN process, tools, and techniques to … Reduce vulnerabilities in the system design through system security engineering … Deliverables 1. Completed Assessment Matrix 2. Recommendation Memo (no more than 5 pages) Submit each deliverable in a separate file. Attach both files to your Project 5 assignment folder entry. Scenario In the organization, there is an insider threat. The employee who is the insider threat was overheard discussing a perceived vulnerability in the enterprise infrastructure. Several members of the IT Operations and Support staff believed that this report (of the alleged vulnerability as perceived / reported by the insider threat employee) represents an actual vulnerability in a key IT system and are attempting to create a patch. Meanwhile, the insider threat employee has released malware into an enterprise IT system which is separate from the alleged vulnerability. While the technical team is searching for the alleged vulnerability, the malware has escaped from the compromised enterprise IT system and is traveling through the enterprise infrastructure disrupting all network traffic. What are the issues that need to be addressed in your analysis of the threats and vulnerabilities present in this scenario? Instructions Complete the matrix from table 4.1 of RAND MR1601 using information provided in the scenario below. A blank copy of the table is provided at the end of this file for your convenience. Required Template You must use the table template as provided in this assignment. Copy the table on the next page into a separate MS Word document file. You may wish to format your document for landscape presentation (to give you more width in each column). Do not modify the column or row headings. Do not delete unused rows or columns (leave them blank). Grading For a “C” on this assignment, you must complete at least one entry in the matrix (table) for 10 or more characteristics (rows) spread across two or more categories (columns). This is a total of 10 points of analysis or 10 cells. (You must have at least one cell filled in for two of the four columns.) For a “B” on this assignment, you must complete at least one entry in the matrix for 12 or more characteristics (rows) spread across three or more categories (columns). This is a total of 12 points of analysis or 12 cells. BUT, for the “B” you must perform your analysis against at least three of the categories (columns). (You must have at least one cell filled in for three of the four columns.) For an “A” on this assignment, you must complete at least one entry in the matrix for 16 or more characteristics (rows) and those entries must be spread across all four categories (columns). This is a total of 16 points of analysis. BUT, for the “A” you must perform your analysis against all four categories. (You must have at least one cell filled in for each of the four columns.) Please see the grading rubric for additional requirements for this assignment. APA Formatting APA formatting is NOT required for this assignment. Your work should have a professional appearance and should use consistent fonts, font sizes, and font colors. Your font size in the matrix (table) should be no smaller than 9 points. TurnItIn Submission Your memorandum must be submitted to TurnItIn for originality checking. Do not submit the matrix to TurnItIn.

Explanation / Answer

Vulnerabilities: A system in a situation that could lead to a potential disaster if not taken care of Disaster Recovery (DR) Contingency policies to recover from a fall over (or failure) as soon as possible Zero down time, may be easy to say in theory but, very hard to implement in reality unless we have very strong vulnerability and recovery support systems There are off shore back up policies – just in case if the whole building is in fire, the data is backed up and stored in a far away building Different type of backup policies: Grand Father Father Son Grand Son Grand Father = Yearly back up Father = Monthly backup Son = Weekly Backup Grand Son = Daily Back up Grand Grand Son = Hourly backup optionally hourly backups can also be implemented in financial institutions like stock and share market brokerages agencies The benefit is that if we lose a data we can always restore the back up and redo only a little amount of work than the whole Threat: Insider – malware We have a 3 fold disaster here 1. The bad employee who is perceived to be a threat as he/she had overheard the key conversations 1.2. Subsequently made a patch – ready to attack 2. as if this is not enough he /she has written a malware and injected it into the system 3. The nasty malware had escaped and populated inside the whole network So in short, the whole IT system is in kiosk (very bad shape) What is the Recovery process? Listed below: First run a system wide virus/malware scan clean all the worms, malware, spying and dubious software back up the data if the scan does not work, the last resort would be to reformat all the hard disks and then install all software and restore data from the scratch – a very time consuming, labor intensive and expensive process – hence keep this as a lost choice if the virus and malware scans did not work The ret of disatser recoovery process applies to this Vulnerability Recovery process as well

Related Questions

Navigate

• Browse (All)
• Browse V
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.