p22

Vulnerability Assessment Summary Report

Executive Summary Comment by Hank Williams: Your focus for the ES is not correct as this is a risk assessment based upon project 1. Please watch the video. Your project is missing key sections per the outline and templates I provided, and it does not address the required information as I laid out in the project 2 video. You’ve done a lot of work here, but since you didn’t actually follow the requirements, most of it is not relevant to the project. I recommend you schedule a meeting with me at your earliest convenience.

Risk assessment is an activity that involves the identification of possible risks and analyzing their impact on the organization. This risks assessment is intended to assist the SGT Inc. to manage its projected risks. SGT Inc is a company that makes and sells airplanes in Maryland. This assessment report is intended for all the company stakeholders-customers, employees, board of directors, government agencies, vendors, and partners. This assessment process has mainly been based on the assessment of different kind of malware that exists in the security system SGT Inc. Information security threats are usually many-they include software attacks, identity theft, and theft of intellectual property, information theft, theft of equipment, information extortion, and sabotage (Mylrea, Gourisetti, Larimer & Noonan, 2018). Software attacks identified in the vulnerability assessment report were the attacks by viruses, Trojan Horses, worms, etc. other malicious software that can attack information software include malware and bots. Comment by Hank Williams: is to provide senior leadership of SGT Inc. with an analysis of the vulnerabilities discovered during the assessment performed on <DATE> to enable them to make informed, risk management decisions relating to these vulnerabilities. Comment by Hank Williams: It should be based on the vul assessment done in project 1.

Malware is malicious software that can be an intrusive program code. It can also be anything designed to perform malicious operations on an information system. There are two types of malware categories: infection methods and malware actions. The following are examples of malware based on infection methods: viruses, worms, Trojan, and bots. Viruses are malicious software that can multiply through hooking themselves into the program. They hook themselves on the host computer through videos, songs, and then they travel to the internet. Examples of viruses include the Ther Creeper, macro virus, file virus, stealth virus, and boot sector virus. Worms are also similar to viruses only that they don’t hook themselves through the program on the host computer (Ten, Liu & Manimaran, 2008). Another difference between worms and viruses is that worms are network-aware. They travel faster in the presence of the internet and can travel from one computer t another. Worms are not highly risky when they are exposed to the target computer. They have minor effects on an organizational information system. The purpose of Trojan horses is to conceal them into software that appears legitimate-after the software has been executed, the Trojan will perform their intended work of either stealing information or any information they are intended to do. Examples include Proxy Trojan, FTP Trojans, and Remote Access Trojans. Bots are an advanced form of warms. Bots are automated processes that can interact over the internet even if there are no human interactions. Their effects can either be good or bad

Another category of malware is based on action. Such malware includes Adware, Spyware, Ransomware, Scareware, Rootkits, Zombies, theft of intellectual property, identity theft, theft of information and equipment, sabotage, and information extortion. Other cybersecurity threats include social media attacks, mobile malware, and technology with weak security, outdated security software, social engineering, and the use of corporate data on personal devices.

Some of the examples of information security vulnerabilities of SGT Inc.that were identified include malware, unpatched security vulnerability, hidden backdoor programs, superuser account privileges, automated running of scripts without virus check, unknown programming interfaces, phishing attacks, IoT devices, and employees. Vulnerabilities that exist in SGT Inc. are due to an anticipated interaction of different software programs, underlying weakness in an individual program, or system components.

Internal threats contribute to more than 60 percent of SGT Inc. security vulnerabilities. Internal vulnerabilities come from partners, employees, and ex-employees (Tucci, 2017). Common internal threats in SGT Inc. security system results from opening malicious emails, accessing corporate systems on unknown people, loss of the laptop and other electronic devices, taking advantage of database privileges, introducing a corrupt tool to the organizational network, social engineering, and becoming victims of phishing schemes. Internal vulnerable also come as a result of the wrong procedures used in the installation of security systems as well as policies used.

Recommended Risk Management Strategies

The specification and selection of a system security control are completed as part of an organizational information security program which entails organizational risk management. Organizational risk management involves the management of risks that appertains to the organizations or management of risks that come from the individuals that operate the system. risk management in an organization is an important component in an organizational information security system. it provides an effective framework for selecting the appropriate security controls for a system. Appropriate security control is one that is necessary to protect the operations, individuals, and assets of the company. The risk management framework I will recommend for SGT Inc. is the risk-based approach. The risk-based framework is a risk management framework that outlines a process that integrates risk management activities and security into the system development life cycle. This approach to security specification and selection considers efficiency, constraints, and effectiveness due to directives, applicable laws, policies, executive orders, regulations, or standards (Wilbanks, 2018). The framework involves the following steps: select controls, implement controls, assess controls, authorize systems, monitor controls, and categorize systems.

The following are the risk management technologies that will be used in this assessment process: risk dashboards, automated processes, risk assessment tools, and advanced risk management tools. Dashboards are considered the easiest technology for undertaking the risk assessment process. The use of dashboard is important because it allows for the creation of helpful views of the current risk profile of a program, portfolio of the project with a few clicks. The business can use a dashboard interface that allows all employees to crate and report to organizational risks in the same way. The use of an automated process is another alternative technology that can be used in risk management through workflows within a tool. This will involve managing all the processes within tool-processes of risk identification, risk assessment, risk management, risk monitoring, and risk escalation.

Risk assessment tools are mainly important during the risk assessment stage. It is an important tool because it makes it easier to compare risks across portfolios and programs. Advanced risk management tools are used for risk modeling. Risk management strategies that have been identified in this study include risk transfer, remediation, acceptance, and mitigation. To remediate means to fix the issue. Mitigate is part of accepting the risk and includes implementing compensating controls because you are not going to fix the issue. Transfer means to transfer the risk to an outside agency such as an insurance company

Risk Management Implementation Recommendations

External factors such as government policies, regulatory factors, and previous industry issues contribute to threats and vulnerabilities in different ways. Threats such as social media attacks and opening malicious emails are cybersecurity threats that are controlled and regulated by the terms and conditions of the software manufacturers. Security software manufacturers are responsible for issuing license and user terms of the devices before they are accessed. When the terms and conditions of the manufacturers do not comply, there can be a serious consequence to the users of the devices. Some of the best practices that can be used to mitigate external factors include the implementation of Password Protocol Policy. Password protocol policy is created for users to enable them to protect their passwords.

This internal vulnerability mitigation practice is achievable through undertaking a thorough explanation and training so that everyone in the organization understands and becomes aware of their roles in system security. CITG is a technology integration company. it plays the role of providing tips on office security. According to the report issued by the company in 2018, the company reported that the establishment of policy and security practices for employees is the best tip for contracting agencies. This protocol is highly recommended because it enables employees who are not well equipped with technological knowledge in an organization to learn and know their roles in system security. Another best practice is the policy that detects malware before the use of network security devices regularly before access to the internet.

SGT Inc is an airplane manufacturing company that sells and makes airplanes in Maryland. In the transport industry, the airplane sector experience most challenges regarding cybersecurity threats. The industry is technologically based and most of the industry information is stored in the information system. the industry issues can contribute to the threats and vulnerabilities that the industry is associated with. The nature of the networks that the industry uses can be easily hacked when adequate security is not put in place to protect the network system.

Threats and vulnerabilities impact businesses in different ways. The impact of the vulnerabilities can be classified as severe, devastating, noticeable, and low. The nature of the threat also determines an organizational response to such threats. Threats that are more likely to cause more harm to the organizations are supposed to be given high priorities. The impact of the threats and vulnerabilities can be estimated in monetary value. The more the vulnerability is severe, the more the amount it will cost to mitigate the risks. The following are some of the vulnerabilities that were identified to be devastating and risky during the vulnerability assessment process: malware, hidden backdoor programs, unknown programming interfaces, and unpatched security vulnerabilities. Those which were identified to have a low impact include phishing attacks, superuser account privileges, and automated running of scripts without virus check.

Since there are many types of malware, the company can consider dealing with those which are highly dangerous to the information system such as viruses, bots, and Trojan. In handling these threats, the organization should consider dealing with the threats which are identified to have major impacts on the organization before going to those which are projected to have minor effects. Internal threats are classified first in consideration of the potential impact of loss from a successful attack. The following factors should be considered in the calculation of information security threats: revenue loss resulting from downtime, infrastructure damage, and the cost required to implement the compensation controls, staff time required for post-incident analysis, legal costs, and post-attack notification cost.

References

Mylrea, M., Gourisetti, S. N. G., Larimer, C., & Noonan, C. (2018, May). Insider threat cybersecurity framework webtool & methodology: Defending against complex cyber-physical threats. In 2018 IEEE Security and Privacy Workshops (SPW) (pp. 207-216). IEEE.

Ten, C. W., Liu, C. C., & Manimaran, G. (2008). Vulnerability assessment of cybersecurity for SCADA systems. IEEE Transactions on Power Systems, 23(4), 1836-1846.

Tucci, A. E. (2017). Cyber risks in the marine transportation system. In Cyber-Physical Security (pp. 113-131). Springer, Cham.

Wilbanks, L. (2018). Whats Your IT Risk Approach?. IT Professional, 20(4), 13-17.