CYB 200 Module Three Case Study Template (8)
docx
keyboard_arrow_up
School
Southern New Hampshire University *
*We aren’t endorsed by this school
Course
200
Subject
Information Systems
Date
Feb 20, 2024
Type
docx
Pages
6
Uploaded by jessxms06
Jessica Brashear
Southern New Hampshire University
Module 3-3 Activity
CYB-200-R1942
September 17, 2023
CYB 200 Module Three Case Study Template
After reviewing the scenario in the Module Three Case Study Activity Guidelines and Rubric document, fill in the table below by completing the following steps:
1.
Specify which Fundamental Security Design Principle applies to the control recommendations by marking the appropriate cells with an X
.
2.
Indicate which security objective (confidentiality, availability, or integrity) applies best to the control recommendations.
3.
Explain your choices in one to two sentences with relevant justifications.
Control
Recommendations
Isolation
Encapsulation
Complete
Mediation
Minimize
Trust Surface
(Reluctance to
Trust)
Trust
Relationships
Security
Objective
Alignment
(CIA)
Explain Your Choices
(1–2 sentences)
Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such X
I
This is an example of utilizing resources how it was intended and deciding if unwarranted transfers are occurring.
Control
Recommendations
Isolation
Encapsulation
Complete
Mediation
Minimize
Trust Surface
(Reluctance to
Trust)
Trust
Relationships
Security
Objective
Alignment
(CIA)
Explain Your Choices
(1–2 sentences)
transfers while alerting information security professionals.
Monitor all traffic leaving the organization to detect any unauthorized use.
X
C
This falls under confidentiality because it is making sure there is no unauthorized access which protects data.
Use an automated tool, such as host-based data loss prevention, to enforce access controls to data even when data is copied off a system.
X
I
Encapsulation because it is utilizing tools for what it was made for. Physically or logically segregated systems should be used to isolate higher-risk software that is required for business operations.
X
A
Segregated systems fall under isolation and will also fall under availability. Make sure that only the resources necessary to perform daily business tasks are assigned to the end users performing such tasks.
X
C
Reducing access to resources depending on job duties is considered minimizing trust surfaces and falls
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
Control
Recommendations
Isolation
Encapsulation
Complete
Mediation
Minimize
Trust Surface
(Reluctance to
Trust)
Trust
Relationships
Security
Objective
Alignment
(CIA)
Explain Your Choices
(1–2 sentences)
under confidentiality.
Install application firewalls on critical servers to validate all traffic going in and out of the server.
X
I
Firewalls check the validity of traffic which falls under integrity.
Require all remote login
access and remote workers to authenticate
to the network using multifactor authentication.
X
C
Authenticating remote access and verifying access to the domain would be
a trust relationship and falls under confidentiality.
Restrict cloud storage access to only the users authorized to have access, and include authentication verification through the use of multi-factor authentication.
X
C
Restricting access to authorized users and authenticating by MFA is complete mediation and falls under confidentiality.
Make sure all data-in-
motion is encrypted.
X
C
Encrypting all data that is in motion is minimizing trust surfaces is considered confidentiality.
Control
Recommendations
Isolation
Encapsulation
Complete
Mediation
Minimize
Trust Surface
(Reluctance to
Trust)
Trust
Relationships
Security
Objective
Alignment
(CIA)
Explain Your Choices
(1–2 sentences)
Set alerts for the security team when users log into the network after normal business hours, or when
users access areas of the network that are unauthorized to them.
X
I
Alerts for network access outside of normal hours or unauthorized network access falls under integrity.
After you have completed the table above, respond to the following short questions:
1.
Is it possible to use DataStore and maintain an isolated environment
? Explain your reasoning. No, it is not possible to use DataStore and maintain an isolated environment because it is a public cloud-based platform and its purpose is to share information between customers.
2.
How could the organization have more effectively applied the principle of minimizing trust surface
with DataStore to protect its confidential data? Explain your reasoning.
The organization can alter the access to employees by restricting access to individuals based on job duties. They can also enable a policy that requires the security team to evaluate the information first.
3.
How can the organization build a more security-aware culture
from the top down to prevent mistakes before they happen? Explain your reasoning. The organization can build a more security-aware culture by implementing mandatory training on security issues and restricting access based on job roles.
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help