Scott J. Straw
Risk Management in Information Technology Security
Summer 2014
6/29/14

Week 2 Assignment – Risk Assessment

In regards to the projected expansion of bandwidth and storage, I feel I should start by addressing some of the present and future potential risks. There are inherent risks to adding new nodes in the network, and some of these can be mitigated by installing and properly configuring new hardware firewalls and proper installation and configuration of Intrusion Detection Systems. In addition to the new hardware, we will also need an additional system administrator, that is not only qualified for the position, but also needs to pass a background check to ensure he/she is not a threat to the federal government’s data and in turn US Industries as a company. A qualitative risk assessment finds the following risks for the network expansion:
QUALITATIVE ANALYSIS SURVEY
CATEGORY PROBABILITY IMPACT RISK LEVEL
Loss of Data Availability 100 100 100
From DoS/DDoS Attack Loss of data from 100 100 100 Unauthorized access Loss of data from Malware 50 100 50 Loss of data from Fire/Natural Disaster 10 100 10 Stolen/corrupt data From lack of access Controls and improper Configuration 10 100 10 Noncompliance with FISMA 10 50 5 Project not finished in time 30 100 30 A quantitative assessment shows the following risks and costs involved with the network expansion: QUANTITATIVE ANALYSIS SURVEY
CATEGORY SLE ARO ALE
Loss of Data Availability 100,000 10 1,000,000
From DoS/DDoS Attack Loss of data from 100,000 10 1,000,000 Unauthorized access Loss of data from Malware 100,000 5 500,000 Loss of data from Fire/Natural Disaster 10,000,000 2 20,000,000 Stolen/corrupt data From lack of access Controls and improper Configuration 1,000,000 2 2,000,000 Noncompliance with FISMA 500,000 1 500,000 Project not finished in time 100,000 3 300,000

The potential losses for loss of data due to any circumstances previously listed are all estimates, except of course for what we could lose in terms of penalties for project incompletion or an inability to maintain FISMA compliance for the US Government, those are real and boldly stated. Besides what has already been stated, the potential future losses include the bad publicity we would receive if we were unable to satisfactorily complete the project in a timely manner, as well as being barred from future projects from said company. In addition to bandwidth expansion hardware, security for the new equipment will need to be implemented and monitored. To do this, we need to have the new system administrator ensure the firewalls and network storage devices are free of vulnerabilities. To ensure this high level of security the systems administrator will need to properly install and configure hardware and software firewalls as well as intrusion detection systems.
The administrator will also need to perform in-depth penetration tests from both internal and external networks. These penetration tests will need to scan for all IP addresses available on both types of networks, including remote employees, to test for open/unnecessary ports, and unnecessary or vulnerable server/client services. In addition, access controls will need to be established so that internal and remote employees only have access to the data they need to do their job. Public facing servers need to be protected with intrusion detection systems and all private or internal servers need to be placed in a DMZ with intrusion detection systems.
All network hardware, servers, and client machines all need to be properly configured, according to best practices, and have ALL default passwords changed. All network equipment transmitting confidential data will need to be configured to encrypt all incoming and outgoing transmissions, from end to end, and all servers and client systems need up to date antivirus software, and to be configured to automatically update and configure anti-malware software and system updates, as well as servers being configured to highest level of security in terms of privileged access to control only necessary root access.
Systems in areas susceptible to natural disasters such as tornadoes or hurricanes need to have insurance and potentially moved to more appropriate locations. Server rooms may need to be expanded or moved to larger, more physically secured locations with state of the art fire detection and suppression equipment and a secure off-site location must be established for regular redundant backups.
According to McAfee security there are 9 essential steps to FISMA compliance, (mandatory to ensure we don’t incur large penalties and to preserve the integrity of US Industries and potential future contract opportunities with the US Government). These steps include:
1) Create a detailed inventory of the systems, networks and internal control mechanisms
2) Assign value to IT assets
3) Identify system/network vulnerabilities
4) Understand threats to federal integrity and information
5) Assess the current security level
6) Development of a prioritized risk management program, based on the protection of critical assets
7) Remediation of major vulnerabilities and risks based on security policies
8) Finally, develop and implement a plan to protect against future/currently unknown threats/vulnerabilities
This will also require perpetual re-evaluation of the systems and vulnerabilities to remain compliant with FISMA and to ensure future survivability of the federal government’s data. If we are unable to satisfactorily complete the project within the 9 month timeframe allotted, we are subject to penalties of $100,000 per month overdue, or even cancellation of the project as a whole if we are unable to do so within 12 months.