CYB_410_3-2_Activity_Branden_Knight
docx
keyboard_arrow_up
School
Southern New Hampshire University *
*We aren’t endorsed by this school
Course
410
Subject
Information Systems
Date
Dec 6, 2023
Type
docx
Pages
4
Uploaded by MateTurtleMaster4095
CYB 410 Module Three Activity
Responding to Risk
Branden Knight
Scenario One – BYOD
You work as an analyst for a fire station that has begun updating it bring your own device
(BYOD) policy. Gaps have been identified in the current policy that would permit any
employee to access the USB ports on their workstations. The firefighters want to use the
USB ports to access movies and music during their free time.
1.
What type of risk do you identify in this scenario?
From within this scenario, I know the identified risk would be that the current BYOD policy
allows almost every employee access to the USB ports which will then create DOS attacks,
and viruses due to an unauthorized device.
2.
How does your identified risk impact the organization?
With the risk factors being high it can affect the organization network entirely making it
vulnerable to exposure of personal and sensitive data.
Malicious code can cause massive damage and could potentially shut down the organization’s
network.
If someone on the inside decides to sell or leak to the general public, this will indeed expose
the entire fire station to legal complications and make the public not trust the fire station.
3.
How would you rate the probability and impact on a scale of low, medium, and high?
The probability would be in between like moderate, and the impact will be high because due
to the reasoning that a USB drive is a tiny device I know can be concealed.
With the fire fighters having the opportunity to have access to the USB ports, makes the
probability of potential consequences more likely than intended.
4.
What do you need to be successful in minimizing the risk?
To help minimize risk, administration should have a policy set in place to have an Acceptable
Use Policy to prevent this from ever happening. This can ensure that the devices are
registered correctly, are not allowed access to restricted areas on the network, and before
using the devices there should be a device checkup.
Also, I know security configurations only should be implemented for outgoing traffic in this
case.
Scenario Two – Data Retention
Your company does not currently have a data retention policy in place because of a limited
IT budget that will not cover the costs of necessary hardware. There have been discussions
about developing one, but the process has been shelved in favor of other projects. Despite
this lack of policy for storing old data, for the next fiscal year no money has been budgeted
1
to buy hardware that could store the additional data long term. Storage space has been
running out, and soon data will need to be deleted to make space for new data.
1.
What type of risk do you identify in this scenario?
Based off the scenario above, the potential risk will involve exposure of data, data corruption,
capacity of storage space, and an overload on servers during the data transfer.
2.
How does your identified risk impact the organization?
The identified risk can impact the organization because it can create as stated above data
corruption, causing servers to overheat, and data loss that will then cause low system
performance.
3.
How would you rate the probability and impact on a scale of low, medium, and high?
The probability will be moderate and high impact. The probability of this happening is slim
but with the impact being high it can cause severe damage.
4.
What do you need to be successful in minimizing the risk?
To minimize risk, I need to ensure or implement a data retention policy to make sure all data
is stored, and it maintains its value.
All data is to be stored and the safety precautions/configurations will be implemented.
The reasoning for a data retention policy is to minimize any potential loss in data, system
logs, and if any logs were backed up.
Scenario Three – Physical Security
Your company is repainting the walls in its server room, which means a small team of
additional workers has been granted access to the space. Usually the door to enter the room
is locked with a key card that prevents entry to anyone without preset permissions. Because
the painters have been moving their own tools in and out, and because they want to keep
the room ventilated, you notice one of them has decided to prop open the door.
1.
What type of risk do you identify in this scenario?
Unauthorized access is allowed to the server room, but it will then make it easier for threat
actors to steal the assets from the company.
Another potential risk of data leaks and the system going down giving the malicious person
direct access server entirely causing more danger.
5.
How does your identified risk impact the organization?
Having unauthorized access to a company’s server, there is an opportunity for data leaks and
malware that was installed. This will destroy the company’s name and reputation.
I know lawsuits will be at the top of this list as well as filling bankruptcy.
6.
How would you rate the probability and impact on a scale of low, medium, and high?
The probability is high due to the fact that there is opening and the impact will be high as
well the malicious attacker is utilizing techniques of social engineering.
7.
What do you need to be successful in minimizing the risk?
2
To minimize risk, physical security measures will have to be in effect including security staff
or guards and cameras to help monitor what’s taking place.
Temporary access cards will be only for work and during scheduled hours.
Overall View
(Scenarios One, Two, and Three)
1.
What is your implementation strategy on a 30/60/90-day timeline?
Scenario One
30-day Plan:
Training in security awareness.
Security policies implemented.
Testing for a security checkup and installation of applications.
60-day Plan:
Security log assessments to identify potential and new vulnerabilities.
Configuring a network with network-based software such as firewalls.
Network testing to help assess functionality.
90-day Plan:
Ensure confirmation that network and system performance is at a high level.
Creation of an Acceptable Use Policy for safety and proper secure internet usage.
Scenario Two
30-day Plan:
Keep on record of inventory of the data.
Include a cost analysis mainly for a comparison of the cost of different storage units or
systems.
Give the risk analysis report to the higher ups, mainly the executives, to help with the
budgeting allocations.
60-day Plan:
Analysis must be finalized of the data and of the data retention policy.
Implement a training routine or schedule with specific detail on different approaches to
implementation for any new storage system.
90-day Plan:
Based on the organization’s standards, all storage systems must be aligned.
A timeframe will be created for implementation of the storage systems, initially.
Approve training for storage systems going forward.
3
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
Scenario Three
30-day Plan:
Must ensure that all access to servers is safe and secure with two-factor authentication or
multi-factor authentication.
Include high level credentials so none of the painter’s badges will access to any part of the
company’s system.
There must be at least a minimum of one security guard for the server room.
Ensure a sign in and sign out sheet is documented with times of every employee.
60-day Plan:
Review and update the painter employee list to ensure only authorized employees have access
to the server room.
Implement daily audits of all sign in and sign out sheets, and access logs. I know this can
ensure all authorized employees are updated.
90-day Plan:
Maintain and check access logs for the server room to ensure stability and security.
All assessments and projects must be on time.
Project progression must maintain on time and updates to changes if necessary.
4