Information Security Lab 4 Assignment

Week 4 Lab

Perform a Qualitative Risk Assessment for an IT Infrastructure

1. Using your favorite search Engine search for more information on the Napster case

2. In your Lab Report file describe the purpose of IT risk assessment

3. Review the following table for the risks, threats and vulnerabilities found in a health care IT infrastructure servicing patients with life-threatening conditions:

Risks, Threats and Vulnerabilities	Primary Domain Impacted	Risk Impact/Factor
Unauthorized access from public Internet
User destroys data in application and delete all files
Hackers penetrates IT infrastructure through modem bank
Intraoffice Employee romance gone bad
Fire destroys primary data center
Service provider service level agreement (SLA) is not achieved
Workstation operating system (OS) has known software vulnerability
Unauthorized access to organization-owned workstations
Loss of production data
Denial of service attack on organization Demilitarized zone (DMZ) and email server
Remote communications from home office
LAN server OS has a known software vulnerability
User downloads and clicks on an unknown e-mail attachment
Workstation browser has software vulnerability
Mobile employee needs secure browser access to sales order entry system.
Service provider has a major network outage
Weak ingress/egress traffic filtering degrades performance
User inserts CDs and USB hard drives with personal photos, music, and videos on organization-owned computers
Virtual Private Network (VPN) tunneling between the remote computer and ingress/egress router
Wireless Local Area Network (WLAN) access points are needed for the LAN connectivity within a warehouse
Need to prevent eavesdropping on WLAN due to customer privacy data access.
Denial of service (DoS) /distributed denial of service( DDoS) attack on WLAN/Internet

4. Review the seven domains of the typical IT Infrastructure

5. In your Lab Report file, using the table, identify the table’s primary domain impacted column which of the seven domains of a typical IT infrastructure will be most impacted by each risk, threat or vulnerability listed.

6. In your Lab Report file, using the table perform a qualitative risk assessment by assigning a risk impact/risk factor to each of the identified tasks, threats and vulnerabilities throughout the seven domains of a typical IT Infrastructure resides. Assign each risk, threat, vulnerability a priority number in the table’s Risk Impact/Factor column, where:

“1” is Critical: a risk, threat, or vulnerability that impacts compliance, (that is, privacy law requirement for securing privacy data and implementing proper security controls and so on) and places the organization in a position of increased liability.

”2” is Major: A risk, threat, or vulnerability that impacts confidentiality, Integrity and availability (C-I-A) of an organization’s intellectual property assets and IT infrastructure.

“3” is Minor: A risk, threat, or vulnerability that can impact user or employee productivity or availability of the IT infrastructure.

Note: Keeping the following in mind when working on the next step: When suggesting next step to executive management, consider your recommendations from their point of view. Be prepared to explain costs both in implementing controls and then in maintaining the controls.

Remember the costs come from many forms, not least of which is labor. Be sure accountability is thought out in terms of roles and responsibilities. Other potential costs outside the data center include goodwill or reputation, market share and lost opportunity. Executive management might have these costs topmost in mind.

7. In your Lab report write a four paragraph executive summary according to the following outline.

· Paragraph #1: Summary of findings (risks, threats, and vulnerabilities found throughout the IT infrastructure)

· Paragraph #2: Approach and prioritization of critical, major, minor risk assessment elements

· Paragraph #3: Risk assessment and risk impact summary of the seven domains of the IT infrastructure

· Paragraph #4: Recommendations and next steps for executive management.