THe question is in PDF file attached

Threat Management and Disaster Recovery Final Paper

This is a two part assignment that will be submitted as one final paper

Part 1

I would like you to complete a limited Risk Assessment for a fictional enterprise. This

analysis, of course, will require you to make lots of assumptions and guesses which

need to be noted and documented in your paper. To limit the scope of the paper, I want

to limit your analysis to threats to the data and servers located in a centralized server

room and threats to connectivity to any wide area network (WAN) clients. You will not

analyze any threats to individual workstations and desktops. What follows is a

description of the server room and connectivity of those servers.

This “made-up” Enterprise is a medical practice with an Electronic Medical Record

(EMR) that we will call “Medco” containing patient data.

This EMR is needed on a 24 hour basis as this is a cardiology specialty and is used in

clinic rooms AND importantly, it is used by emergency physicians in the local trauma

center for treatment of patients suffering from life threatening heart issues. This requires

a WAN connection to be made available 24 hours a day.

The Environment

Servers

 Server 1 is Microsoft Exchange Server

 Server 2 is Domain Controller

 Server 3 is a Citrix Server (delivering applications as Thin Clients to desktops

and some of the WAN clients)

 Server 4 is Web Server running IIS to present main application as web pages

 Server 5 is a Server Running Microsoft SQL Server with patient data

The Servers are connected to the LAN using routers and switches.

The Servers are connected to the Internet using a single Firewall via a single

connection to a single Internet Service Provider (ISP).

The Servers do connect to a WAN using this Internet connection using a VPN and the

nodes on this WAN (clinics around the state) each have a single connection to an ISP in

their local area.

Physically all the Servers are in a single unlocked room that has no fire suppression

equipment other than the typical building sprinkler system and there are two sprinkler

systems in the server room.

The servers are connected to a trunk electrical line that is not part of the medical

centers emergency power system and there is no line conditioning.

For temperature control, the server room relies on the existing building HVAC system

with heat exchangers located on the roof of the building. There is one air conditioning

vent and one room thermostat serving the server room.

The Assignment

Using the NIST Special Publication 800-30, complete a Risk Assessment to identify

potential threats for which a matching vulnerability exists in the above described

environment. You can pretend that you are the Security officer in charge of this

Assessment and also for your control recommendation you can make decisions from

your Risk Matrix as if you were upper management.

This part of the paper should be at least 3 pages and should be no more than 5 pages

not including items such as interview forms or spreadsheets.

Part II

Unfortunately, before your recommendations from your Risk Assessment (Part I) were

implemented a power supply on one of the servers failed and created a fire that

destroyed the server with the database and all the patient data was lost. After the

disaster, the practice returned to paper patient records and management gave you the

charge to rebuild the system with more safeguards and importantly a more complete

plan for data backup and data restore. For the second part of this paper I would like to

choose a backup strategy (tape, disk array backup, cloud backup, mirrored servers and

distributed database, etc) to make recovery from any future disaster within a short time

possible. I want you to fully describe your solution to backup and recovery and detail

some of the particulars of why you chose that solution. This will entail giving the pros

and cons of the alternatives you considered and reasons for your choice of this

particular solution.

This part of the paper should be also at least 3 pages and no more than 5 pages not

including any tables or figures.

You should do your own work and any reference materials explicitly cited in the paper

and put in quotes if directly transcribed. The paper will be submitted online through the

Turnitin assignment and will be checked for plagiarism.