CYB_100_3-3
docx
keyboard_arrow_up
School
Southern New Hampshire University *
*We aren’t endorsed by this school
Course
100
Subject
Information Systems
Date
Dec 6, 2023
Type
docx
Pages
9
Uploaded by DrTree1894
CYB 200 Module Three Case Study
Control
Recommendations
Isolatio
n
Encapsulatio
n
Complet
e
Mediatio
n
Minimize
Trust
Surface
(Reluctance
to Trust)
Trust
Relationship
s
Security
Objectiv
e
Alignme
nt (CIA)
Explain Your
Choices
(1–2 sentences)
Deploy an automated tool on network perimeters that monitors for unauthorized transfer of sensitive information and blocks such transfers while alerting information security professionals.
X
X
C
Transfers are being checked to ensure they are not of a sensitive nature and
are allowed to be transferred. This is limiting the amount
of information that is entrusted to the third-party cloud. Monitor all traffic X
C
All data is being
Control
Recommendations
Isolatio
n
Encapsulatio
n
Complet
e
Mediatio
n
Minimize
Trust
Surface
(Reluctance
to Trust)
Trust
Relationship
s
Security
Objectiv
e
Alignme
nt (CIA)
Explain Your
Choices
(1–2 sentences)
leaving the organization to detect any unauthorized use.
checked to ensure it
is allowed. Essentially the definition of complete mediation. Use an automated tool, such as host-
based data loss prevention, to enforce access controls to data
even when data is copied off a system.
X
C
The cloud has a has
a copy of the trust relationships of who can access what. Physically or logically
X
C + I
Higher-risk
Control
Recommendations
Isolatio
n
Encapsulatio
n
Complet
e
Mediatio
n
Minimize
Trust
Surface
(Reluctance
to Trust)
Trust
Relationship
s
Security
Objectiv
e
Alignme
nt (CIA)
Explain Your
Choices
(1–2 sentences)
segregated systems should be used to isolate higher-risk software that is required for business operations.
Software is being isolated to protect data from unauthorized use or
changes. Make sure that only the resources necessary to perform daily business tasks are assigned to the end
users performing such tasks.
X
X
A
End users are only trusted with the information essential for their job tasks. Data is available to those who need it but not
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
Control
Recommendations
Isolatio
n
Encapsulatio
n
Complet
e
Mediatio
n
Minimize
Trust
Surface
(Reluctance
to Trust)
Trust
Relationship
s
Security
Objectiv
e
Alignme
nt (CIA)
Explain Your
Choices
(1–2 sentences)
to users who do not need it to perform their job. Install application firewalls on critical servers to validate all traffic going in and out of the server.
X
X
C Firewalls default to not allow data through unless it is explicitly allowed through. Require all remote login access and remote workers to authenticate to the network using multifactor X
X
A
Multifactor authentication allows for establishing which users are trusted with which type of
Control
Recommendations
Isolatio
n
Encapsulatio
n
Complet
e
Mediatio
n
Minimize
Trust
Surface
(Reluctance
to Trust)
Trust
Relationship
s
Security
Objectiv
e
Alignme
nt (CIA)
Explain Your
Choices
(1–2 sentences)
authentication.
information based on their username and defined level of
access. Restrict cloud storage access to only the users authorized to have access, and include authentication verification through the use of multi-factor
authentication.
X
X
I
Could relate to all three of the CIA triad. The cloud is set to decern which users are trusted with what data and thus data is protected from unauthorized
Control
Recommendations
Isolatio
n
Encapsulatio
n
Complet
e
Mediatio
n
Minimize
Trust
Surface
(Reluctance
to Trust)
Trust
Relationship
s
Security
Objectiv
e
Alignme
nt (CIA)
Explain Your
Choices
(1–2 sentences)
viewing or changes but is still available to users who need it. Make sure all data-in-
motion is encrypted.
X
X
C
All data is being checked and protected. Data cannot be viewed by unauthorized users. Set alerts for the security team when users log into the network after normal X
X
C + I
All data is being checked to see if it is allowed and the security team can
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
Control
Recommendations
Isolatio
n
Encapsulatio
n
Complet
e
Mediatio
n
Minimize
Trust
Surface
(Reluctance
to Trust)
Trust
Relationship
s
Security
Objectiv
e
Alignme
nt (CIA)
Explain Your
Choices
(1–2 sentences)
business hours, or when users access areas of the network that are unauthorized to them.
ensure that programs are only being used as intended during normal business hours.
1.
Is it possible to use DataStore and maintain an isolated environment
Technically any data that is stored with DataStore is by definition not in an isolated environment. However, any data that is specifically kept off DataStore’s cloud could be in an isolated environment. So yes, it is possible to use DataStore and maintain an isolated environment so long as sensitive data is kept off the cloud and saved in an isolated environment on the company’s computers where only employees can access it. 1.
How could the organization have more effectively applied the principle of minimizing trust surface
with DataStore to protect its confidential
data? Explain your reasoning. Some examples of how the organization could apply the principle of minimizing trust surface with DataStore are:
a.
Restrict cloud storage access to only the users authorized to have access and include authentication verification through the use of multi-factor authentication.
b.
Use an automated tool, such as host-based data loss prevention, to enforce access controls to data even when data is copied off a system. c.
Monitor all traffic leaving the organization to detect any unauthorized use. d.
Deploy an automated tool on network perimeters that monitors for unauthorized transfer of sensitive information and blocks such transfers while alerting information security professionals.
All of these ensure that minimal data is being shared with DataStore. DataStore is thus being trusted as minimally as possible. These practices
would ensure that sensitive data is not placed on the cloud where it can be easily viewed, and its integrity is preserved by keeping it only on secure company computers and servers. 2.
How can the organization build a more security-aware culture
from the top down to prevent mistakes before they happen? Explain your reasoning.
The best way to build a more security-aware culture is to ensure that all employees are aware of the company’s security protocols and why they are important. One way to do this is to have quarterly training courses on the importance of data security. The higher-level employees, managers, heads of departments and even the CEO should be involved in these training courses. As they say the fish rots from the head down and if the higher-level employees who have the highest level of access to sensitive data are not taking security seriously then lower level employees won’t take it seriously either. Another thing some organizations do is test employees on their security awareness in ways such as sending a fake phishing scam email to employees to see who is following procedure and reporting these types of emails and who was susceptible to them and clicked on them anyway.
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help