The security assessment report is prepared following the octave methodology and the different criteria for the analysis of the risk is applied for the development of the risk mitigation plan. The octave methodology is applied because it is the best suited risk analysis method for AMC Pvt. Ltd. having more than 300 employees working in the organization. For the identification of the risk the following three phases are used.
Process 1: Determination of critical assets and how they are currently protected
The assets can be identified according to the information assets, software assets, physical assets and services.
The information assets can be of different form such as the customer information, accounts information, employee information, etc. The database server contains all the organizational information of AMC Pvt. Ltd. and its confidentiality and the integrity is maintained for maintaining the availability of data (21). The data files needs to be updated at a real time and detailed instruction must be provided for the performing different activities on the network. The old information in the database needs to be archived for saving space and maintain backup of the data.
The software assets are divided into two types such as application and system software. The application software is used for the implementation of the business rules and use of third party application software must be avoided because it can cause a flaw in the system and the intruder can get the access of the network by entering through an open port (4). The system software is such as DBMS, office productivity packages must be updated regularly with security patches.
The physical assets of AMC Pvt. Ltd. can be tangible or intangible and it consists of different computer equipment’s such as mainframe computers, servers, notebooks, desktops. There are different storage media and communication equipment’s such as modems, routers, fax machines, CDs, etc (16).
Process 2: Identification of security requirement for the critical assets
There is a need to establish the accountability of the assets and the fixed assets of AMC Pvt. Ltd. should be maintained in a list for calculating the depreciation of the assets. The ownership of the assets must be established for increasing the accuracy of the calculation of the assets. The establishment of the ownership is a difficult job and if there is a change in the information the database must be updated (9). The business heads must be involved for addition of the ownership and should be given the power of decide the business value. It is essential to identify the business value of the asset for the development of the security requirement. The owner of the application software should also be identified for aligning the software according to the business rules of the AMC Pvt. Ltd. (7). The ownership of the system software should be identified for defending the organization from piracy.
Process 3: Identification of the organizational vulnerabilities within existing practices
There are different services such as outsourcing the maintenance and support team, communication services such as data and voice communication. There are other environmental services such as air conditioning, lightning and power supply. Assessment of the onsite component and completion within the scheduled time period.
Examination of different strategy for the application in the development process and handling the incidents and potential threats and increasing the safety of the workplace environment.
Management of the stakeholder’s identification of the requirement for the development of the network solution (3).
The strength and weakness of the network should be identified for the development of the network framework and align the needs with the proposed network design
For the assessment of the vulnerability interviews must be arranged with the stakeholders and their behavior and participation should be analyzed for identification of the behavior issues.
Process 4: Creation of a threat profile for the critical assets
For the development of the network solution it is important to identify the critical assets and their usage pattern for reducing the risk associated with the security of the network solution. The policy and the guidelines should be assessed and the respondents to any of the incidents should be identified for increasing the performance and addressing the threats acting on the network. Security training programs must be arranged for the faculty and the staffs such that the network and the other resources are used wisely and the responsibility should be understood by the users for management of a safe workplace environment (14). For the identification and the classification of the assets an organized structure is created and it helps in getting a better direction and administrative control over the network solution created for the AMC Pvt. Ltd.
Process 5: Identification of network access paths and IT components related to the critical assets
It is important to create a classification level following the confidentiality, value, right to access and the destruction level. The confidentiality is maintained for restricting a specific group of users to access the sensitive organizational information such as manufacturing secrets, plans, etc. It is maintained based on different factors such as confidential, only for company, shared or unclassified (13). Some of the information are kept in the database for the use of organizational purpose such as the customer database and manufacturing process. Some of the resources could be shared and the contact information should be shared with the agents and the employees for maintaining a proper communication management plan. The information should be secured because the information can be used by competitors for illegal use. The infrastructure of AMC Pvt. Ltd. is analyzed for the identification of the critical assets and identification of the vulnerability of the assets. There is different potential impact than can negatively impact the growth of the AMC Pvt. Ltd. The risk with higher score have higher impact and it should be prioritized for the creation of a risk mitigation plan. The threat scenario is used as a threat tree and there are different technical problems related with the access of the network resources. Different problem may arise that is required to be controlled by the organization and the unavailability of the critical infrastructure can mitigate the problem.
Process 6: Evaluation of the IT components
It is important to implement a classification schema for the easy identification of the resources required for the development of the network solution. The business plan of the company should be analyzed and it should be protected from illegal access. The business plan should be discussed confidentially (8). The communication channel used for communicating with the stakeholders must be encrypted and strong passwords must be used for protecting the assets and monitored for increasing the security.
Process 7: Conducting the risk analysis
There are several risk associated with the development of the network security information system and the risk may arise from different sources and its impact should be analyzed for the preparation of the risk mitigation plan. The assessment of risk is important for the risk management process and security practices must be followed such as the compliance of the standards of the hardware devices installed for the development of the information system (10). There are other risk associated with the involvement of the third party users for the development of the information system. The risk is determined by identification of the impact and is categorized into high, medium and low.
Process 8: Development of protection strategy and mitigation plan
|
Risk Description |
Priority levels |
Relevant risk |
Risk cause |
Mitigation |
|
Losing the confidentiality and integrity of the resources of the network that can affect the organizational growth negatively (2). The attack from different points can cause access of the sensitive organizational information that can cause loss of the organizational information. |
High |
The risk is caused for the data and the physical environment. |
Malicious and sabotage attacks |
For the mitigation of the risk the web server needs to be configured and antivirus program must be installed for protecting the system from spyware and virus. The malicious codes can be by hackers to launch DoS attack and fetch all the data (1). A strong username and password should be used for increasing the security and protect the data from illegal access. |
The risk associated with the network and the information system are categorized according to its severity and categorized as critical, major, normal and minor.
Critical issues
Major issues
Normal issues
Minor issues
For the development of the business continuity plan the risk that can have a negative impact on the growth of the current business are determined. This step is followed by the determination of the important tasks which is required for the mitigation of the risk. The people and the tools required for the development of the network and information security should be identified. The business continuity plan should consists of all the details of the stakeholders and their contact information. The details of the office, backups and the disaster recovery plans should also be included for the development of the business continuity plan. The recovery strategies should be documented in the plan and it helps AMC Pvt. Ltd. to respond quickly against the disruption and restore the essential services. The main objectives of the business continuity plan is to identify the procedures and arrangements for maintaining a continuous improvement and respond against the critical business functions.
The business continuity plan is used for maintaining a constant growth in AMC Pvt. Ltd. and handle the emergency condition such that the all the potential threats are avoided. All the potential threats must be analyzed the business continuity plan consists of the following items.
The business continuity plan is used for reducing the injury and protect AMC Pvt. Ltd. assets from damage for reducing the losses and damages of the business functions. A communication should be maintained between the stakeholders for coordinating with each other and executing for the recovery (6). A project schedule should be created for the management of the activity and each of the steps should be monitored for the reducing the error in the development of the information system and the network solution. For the involvement of the third party vendor all the information must be included such as the contact information, the ability to recover and the service provided for maintaining a transparency in the current business process (13). The communication is the key point of success, thus all the details of the stakeholders and the vendors must be maintained.
Temporary facilities should be provided to the employees such as providing support to the employees and alternative course of action should be identified for handling the crisis. If there is a change in the business operation the business continuity plan should be updated for reducing the errors (17). A management team should be created for the management of the current business operations and the team roles and responsibility should be divided for analysis of the business impact. A questionnaire should be developed for gathering the input from the users and understanding the necessity of the users for the development of the information security network (23). The progress of the project should be discussed with the stakeholders with the arrangement of weekly meetings and getting the approval of the stakeholders for finalizing the requirement of the project. The leading responsibility should be taken by the response team for handling the emergency condition and respond to the crisis. For the activation of the business continuity plan the following procedures must be followed:
Condition for warning –
With and without warning
If a warning is received a notification should be generated for implementation of risk mitigation plan and reduce the errors in the project.
If no warning is received the risk that may affect the system should be analyzed according to the severity and different defense mechanism such as configuration of the router with firewall policy should be applied (20). The monitoring of the network is important for the generation of the alert and secure the network and the information system from unauthorized access.
Identification of the potential disaster status
For the identification of the potential disaster status the following criteria should be evaluated.
Control and Direction
The success of the development of the network and information security system depends on the management and on the availability of the resources (24). The project manager should monitor the progress of the development of the network and arrange the resources required for the development. An estimation of the cost of the equipment required should be prepared for the calculation of the budget. A team should be developed for starting the development process and roles and responsibility must be assigned for reducing the risk. The control on the project team must be maintained such that the project is completed within the estimated time and budget. A communication plan should be prepared such that it prevents the loss of data and improve the performance of the development process (19). The continuity plan should consists of the communication plan such that it can be followed for communicating with the higher level employees working in AMC Pvt. Ltd.
Purpose
The main purpose of the development of the security policy is to protect the information of AMC Pvt. Ltd. and the technological assets. The security policy of the organization should consists of the company plan and its employees must be trained to protect the asset of the company. Organized methodology and risk assessment strategy should be implemented for the deployment of the security mechanism and improve the security of the network and information system.
Policy
Risk assessment and audit
Physical and environmental security
Access control to the network
Remote access
Access of third party
References
Essay Writing Service Features
Our Experience
No matter how complex your assignment is, we can find the right professional for your specific task. Contact Essay is an essay writing company that hires only the smartest minds to help you with your projects. Our expertise allows us to provide students with high-quality academic writing, editing & proofreading services.
Free Features
Free revision policy
$10Free bibliography & reference
$8Free title page
$8Free formatting
$8How Our Essay Writing Service Works
First, you will need to complete an order form. It's not difficult but, in case there is anything you find not to be clear, you may always call us so that we can guide you through it. On the order form, you will need to include some basic information concerning your order: subject, topic, number of pages, etc. We also encourage our clients to upload any relevant information or sources that will help.
Complete the order form
Once we have all the information and instructions that we need, we select the most suitable writer for your assignment. While everything seems to be clear, the writer, who has complete knowledge of the subject, may need clarification from you. It is at that point that you would receive a call or email from us.
Writer’s assignment
As soon as the writer has finished, it will be delivered both to the website and to your email address so that you will not miss it. If your deadline is close at hand, we will place a call to you to make sure that you receive the paper on time.
Completing the order and download
