...Application Activity 1: Interview someone at the company of your choice who handles network administration or a help desk professional who handles the administration of any of the operating systems identified in this course. It is important to select an individual that has a functional knowledge of identifying types of cyber-attacks, designing and implementing measures to respond to such an event, and understands different forms of malicious code. While an in-person interview is preferred, you can also conduct this interview by phone or e-mail. During your interview be sure to inquire as to the individual’s job title and daily responsibilities. Also, be sure to discuss the problems that exist with monitoring network activity, to include access controls, cryptography, and identifying malicious code. In addition, note the features of operating systems that typically benefit organizations in terms of security benefits. Lastly, inquire as to the career potential that exists in network security and related fields. Feel free to ask many additional questions, as these questions are given to ensure key areas are identified. Once you have concluded your interview, gather your data and draft a report detailing the information gained as a result of the interview. Your report should be a minimum of 5 pages excluding the title page and references. There must be a minimum of 5 peer-reviewed sources included. • Interviewee’s job title and daily responsibilities are included. • What problems...
Words: 370 - Pages: 2
...Assignment 2: Identifying Potential Risk, Response, and Recovery Emory Evans August 26, 2012 Dr. Robert Whale CIS 333 There are a myriad of potential threats and vulnerabilities that leave a system open to malicious attack, anytime you have a computer network that connects to the internet there is a potential for malicious attack so it is important that you know the vulnerabilities of a system to protect it from potential threats and malicious attacks. “A vulnerability is any weakness in a system that makes it possible for a threat to cause harm.” (Kim & Solomon, 2012, p. 96). There are several common vulnerabilities that exist within the seven domains of an IT infrastructure for example there is the lack of awareness or concern for security policy vulnerability in the User Domain as well as intentional malicious activity ( Kim & Solomon, 2012). Within the Workstation Domain there exists unauthorized user access, weakness in installed software, and malicious software introduced vulnerabilities, unauthorized network access, transmitting private data unencrypted, spreading malicious software, exposure and unauthorized access of internal resources to the public, introduction of malicious software, loss of productivity due to internet access, denial of service attacks, brute-force attacks on access and private data are all examples of vulnerabilities within the seven domains of IT infrastructure which are User, Workstation, LAN...
Words: 705 - Pages: 3
...paragraph, and on the Tools menu click Word Count. Title of Paper In this assignment, I will write a four to five report in how to thwart a malicious attacks, threats, vulnerabilities to a game system. I have just been hired as an Information System Engineer for a videogame development company. The organization network structure have been identified by the company as having 2- firewall, 1- Web/FTP server, 1-Microsoft Exchange Email Server, Network Intrusion Detection System(NIDS), 2-Windows Server 2012 Active Directory Domain Controllers(DC) 3-File servers 1-Wireless access point(WAP) 100-Desktop/Laptop computers VoIP telephone system. The CIO of this company has just received a report of malicious activities on the rise and has become extremely concerned with the protection of intellectual property and highly sensitive data maintained by his organization. As part of my job task with the organization, I will identify and draft a report identifying potential malicious attacks, threats, and the vulnerabilities that is specific to his organizations. It has been requested that in the report, I give a brief scenario explanation and how what kind of potential impact it will have on the organization. Any threat is alarming because it could damage the assets of the company if this is true we first need to have a Business Continuity Plan (BCP) which allows the company to keep operating in case of an attack. My order of planning would be to discover the disaster recovery...
Words: 401 - Pages: 2
...Week 3 Lab Part 1: Web and Database Attacks & Malware and Malicious Software Learning Objectives and Outcomes Upon completing this lab, students will be able to: * Identify web application and web server backend database vulnerabilities as viable attack vectors * Develop an attack plan to compromise and exploit a web site using cross-site scripting (XSS) against sample vulnerable web applications * Conduct a manual Cross-site Scripting (XSS) attack against sample vulnerable web applications * Perform SQL injection attacks against sample vulnerable web applications with e-commerce data entry fields * Mitigate known web application and web server vulnerabilities with security countermeasures to eliminate risk from compromise and exploitation Overview This Lab will demonstrate a Cross-site Scripting (XSS) exploit and an SQL Injection attack on the test bed web application and web server using the Damn Vulnerable Web App (DVWA) loaded on an Apache Web Server on “TargetUbuntu01” Linux VM server. They will first identify the IP target host, identify known vulnerabilities and exploits, and then attack the web application and web server using XSS and an SQL Injection to exploit the web application using a web browser and some simple command strings. Assignment Requirements Watch the Demo Lab in Learning Space Unit 5 and then answer questions 1-10 below. Lab Assessment Questions & Answers 1. Why is it critical...
Words: 1054 - Pages: 5
...protected health information of your customers. Your supervisor has tasked you with identifying inherent risks associated with this pharmacy and establishing physical and logical access control methods that will mitigate the risks identified. 1. Firewall (1) 2. Windows 2008 Active Directory Domain Controllers (DC) (1) 3. File Server (1) 4. Desktop computers (4) 5. Dedicated T1 Connection (1) Write a ten to fifteen (10-15) page paper in which you: 6. Identify and analyze any potential physical vulnerabilities and threats that require consideration. 7. Identify and analyze any potential logical vulnerabilities and threats that require consideration. 8. Illustrate in writing the potential impact of all identified physical vulnerabilities and threats to the network and the pharmacy. 9. Identify all potential vulnerabilities that may exist in the documented network. 10. Illustrate in writing the potential impact of all identified logical vulnerabilities to the network and the pharmacy. 11. For each physical vulnerability and threat identified, choose a strategy for dealing with the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance). 12. For each logical vulnerability and threat identified, choose a strategy for dealing with the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk...
Words: 520 - Pages: 3
...Assignment 1: Identifying Potential Malicious Attacks, Threats, and Vulnerabilities Shauna Video games have been around for many years. As technology progresses unfortunately so does the security risks that come with online gaming. “The number of American households which play video games is a roughly 65%.” (Source 2) With any network organization you want to make sure that you keep on top of vulnerabilities of anything that reaches out to the internet. Computers and servers that touch the internet are ones that must be scanned. As a company you have to make sure that you configure the security settings for the operating system, internet browser and security software. As a company you also want to set personal security policies for online behavior. There also needs to be an antivirus installed on the network like Norton or Symantec which blocks threats targeting the vulnerabilities. “With the firewalls you want to configure them in the reputable internet security program to block unsolicited request communication.” (Source 1) Email server needs to be sure that spam doesn’t get through the network. The ways that spam works is unwanted email messages get solicited to a large number of recipients. “Spam should be a major concern in your infrastructure since it can be used to deliver email which can include Trojan horses, viruses, worms’ spyware and targeted attacks aimed specifically in obtaining sensitive and personal identification information...
Words: 1027 - Pages: 5
...Payment Card Industry (PCI) Data Security Standard Requirements and Security Assessment Procedures Version 3.2 April 2016 Document Changes Date October 2008 Version 1.2 Description Pages To introduce PCI DSS v1.2 as “PCI DSS Requirements and Security Assessment Procedures,” eliminating redundancy between documents, and make both general and specific changes from PCI DSS Security Audit Procedures v1.1. For complete information, see PCI Data Security Standard Summary of Changes from PCI DSS Version 1.1 to 1.2. Add sentence that was incorrectly deleted between PCI DSS v1.1 and v1.2. Correct “then” to “than” in testing procedures 6.3.7.a and 6.3.7.b. 1.2.1 32 Remove grayed-out marking for “in place” and “not in place” columns in testing procedure 6.5.b. 33 For Compensating Controls Worksheet – Completed Example, correct wording at top of page to say “Use this worksheet to define compensating controls for any requirement noted as ‘in place’ via compensating controls.” July 2009 5 64 October 2010 2.0 Update and implement changes from v1.2.1. See PCI DSS – Summary of Changes from PCI DSS Version 1.2.1 to 2.0. November 2013 3.0 Update from v2.0. See PCI DSS – Summary of Changes from PCI DSS Version 2.0 to 3.0. April 2015 3.1 Update from PCI DSS v3.0. See PCI DSS – Summary of Changes from PCI DSS Version 3.0 to 3.1 for details of changes. April 2016 3.2 Update from PCI DSS v3.1. See PCI DSS...
Words: 57566 - Pages: 231
...Security Assessment and Solutions for Quality Web Design Course Project Final Executive Summary The first phase of this paper is to identify inherent security weaknesses on a specific component among one of two businesses; Quality Web Design, an organization specializing in Web site and Web site content design; and Aircraft Solutions, a well-known manufacturer in the design and fabrication of component products and services for companies in the electronics, commercial, defense, and aerospace industry. The assignment includes identifying the organization’s weaknesses by selecting one of their assets and addressing two of the following three areas: software, hardware and policy. A general description of the company’s overview and business processes is provided, along with a list of digital assets mapped into their respective network diagrams. Phase two follows with recommended solutions to the weaknesses, and its impact to the security controls of the business. Security Assessment and Solutions for Quality Web Design Course Project Final Protecting our valuables, whether they are expressed as information or in some other way, ranges from quite unsophisticated to very sophisticated. We can think of the Wild West days as an example of the “unsophisticated” end of the security spectrum. And even today, when we have more sophisticated means of protection than ever before, we still see a wide range in how people and businesses actually use the protections available to them...
Words: 2438 - Pages: 10
...CHAPTER 7 INFORMATION SYSTEM CONTROLS for SYSTEMS RELIABILITY SUGGESTED ANSWERS TO DISCUSSION QUESTIONS 7.1 1. Encryption is the final layer of preventative controls in that encrypting data provides a barrier against an intruder who has obtained access to company data. Encryption employing a digital signature and a public key infrastructure (PKI) can also strengthen authentication procedures and helps to ensure and verify the validity of e-business transactions. The digital signature is some sort of identifying information about the signer that is encrypted with the signer’s private key. This identifying information can only be decrypted using the corresponding public key. Since a private key is only known to it’s owner, only the owner can hold both the public and the private key and be the creator of the digital signature. Thus, digital signatures can be used to authenticate a particular party involved in a transaction as being the creator of a document. This provides for non-repudiation: the creator of the digital signature cannot deny having signed a document.. A digital certificate is an electronic document that is digitally signed by a trusted third party that certifies the identity of the owner of a pair of public and private keys. The PKI is a system that is used to process and manage the public and private keys used in digital signatures and digital certificates. An organization that handles digital certificates is called a certificate...
Words: 5091 - Pages: 21
...missing cover sheet will be returned for resubmission. Submit to: Western Governors University Attn.: Assessment Delivery Department 4001 South 700 East, Suite 700 Salt Lake City, Utah 84107-2533 wgusubmittals@wgu.edu Capstone Project Cover Sheet Capstone Project Title: Vulnerability Management Plan Student Name: Mike Douglas Degree Program: Bachelor of Science Information Technology Security Mentor Name: Martin Palma Signature Block Student’s Signature Mentor’s Signature Table of Contents Capstone Report Summary (Introduction) 1 Review of Other Work 3 Rationale and Systems Analysis 8 Goals and Objectives 13 Project Timeline 22 Project Development 24 References 28 Appendix 1: Competency Matrix 29 Appendix 2: CVSS GUIDE 32 Appendix 3: DICES IV vulnerability management plan 33 Capstone Report Summary (Introduction) Digital Integrated Communications Electronic System version IV (DICES IV) is a critical piece of communications infrastructure relied on to ensure missile launch success. When a single mission’s price tag soars into the tens and sometimes hundreds of millions of dollars, management of hardware, software, and personnel risks and vulnerabilities must be included to mitigate events that...
Words: 6924 - Pages: 28
...The Critical Security Controls for Effective Cyber Defense Version 5.0 1 Introduction ..................................................................................................................................................................... 3 CSC 1: Inventory of Authorized and Unauthorized Devices ............................................................................ 8 CSC 2: Inventory of Authorized and Unauthorized Software ....................................................................... 14 CSC 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers ....................................................................................................................................... 19 CSC 4: Continuous Vulnerability Assessment and Remediation ................................................................. 27 CSC 5: Malware Defenses .......................................................................................................................................... 33 CSC 6: Application Software...
Words: 31673 - Pages: 127
...GIVEAWAY SMALL HOSPITAL GRANTS TRACKING SYSTEM INITIAL RISK ASSESSMENT PREPARED BY: WE TEST EVERYTHING LLC Jerry L. Davis, CISSP, Sr. Analyst EXECUTIVE SUMMARY .......................................................................................................... 4 1. INTRODUCTION..................................................................................................................... 7 Background ............................................................................................................................................................... 7 Purpose .....................................................................................................................................................................7 Scope ........................................................................................................................................................................7 Report Organization..................................................................................................................................................8 2. RISK ASSESSMENT APPROACH ........................................................................................ 9 2.1 Step 1: Define System Boundary ....................................................................................................................9 2.2 Step 2: Gather Information ...................................................................................................
Words: 10420 - Pages: 42
...GIVEAWAY SMALL HOSPITAL GRANTS TRACKING SYSTEM INITIAL RISK ASSESSMENT PREPARED BY: WE TEST EVERYTHING LLC Jerry L. Davis, CISSP, Sr. Analyst EXECUTIVE SUMMARY .......................................................................................................... 4 1. INTRODUCTION..................................................................................................................... 7 Background ............................................................................................................................................................... 7 Purpose .....................................................................................................................................................................7 Scope ........................................................................................................................................................................7 Report Organization..................................................................................................................................................8 2. RISK ASSESSMENT APPROACH ........................................................................................ 9 2.1 2.2 Step 1: Define System Boundary ....................................................................................................................9 Step 2: Gather Information .......................................................................................................
Words: 10420 - Pages: 42
...THREAT MODELING AND ITS USAGE IN MITIGATING SECURITY THREATS IN AN APPLICATION Thesis Submitted in partial fulfillment of the requirements for the degree of MASTER OF TECHNOLOGY in COMPUTER SCIENCE & ENGINEERING - INFORMATION SECURITY by EBENEZER JANGAM (07IS02F) DEPARTMENT OF COMPUTER ENGINEERING NATIONAL INSTITUTE OF TECHNOLOGY KARNATAKA SURATHKAL, MANGALORE-575025 JULY, 2009 Dedicated To My Family, Brothers & Suraksha Group Members DECLARATION I hereby declare that the Report of the P.G Project Work entitled "THREAT MODELING AND ITS USAGE IN MITIGATING SECURITY THREATS IN AN APPLICATION" which is being submitted to the National Institute of Technology Karnataka, Surathkal, in partial fulfillment of the requirements for the award of the Degree of Master of Technology in Computer Science & Engineering - Information Security in the Department of Computer Engineering, is a bonafide report of the work carried out by me. The material contained in this report has not been submitted to any University or Institution for the award of any degree. ……………………………………………………………………………….. (Register Number, Name & Signature of the Student) Department of Computer Engineering Place: NITK, SURATHKAL Date: ............................ CERTIFICATE This is to certify that the P.G Project Work Report entitled " THREAT MODELING AND ITS USAGE IN MITIGATING SECURITY THREATS IN AN APPLICATION" submitted by Ebenezer Jangam (Register Number:07IS02F)...
Words: 18945 - Pages: 76
...this chapter, you will be able to answer the following questions: 1. Why are information systems vulnerable to destruction, error, and abuse? What is the business value of security and control? What are the components of an organizational framework for security and control? What are the most important tools and technologies for safeguarding information resources? 2. 3. 4. ISBN 1-256-42913-9 232 Essentials of MIS, Ninth Edition, by Kenneth C. Laudon and Jane P. Laudon. Published by Prentice Hall. Copyright © 2011 by Pearson Education, Inc. C HAPTER O UTLINE Chapter-Opening Case: Boston Celtics Score Big Points Against Spyware 7.1 System Vulnerability and Abuse 7.2 Business Value of Security and Control 7.3 Establishing a Framework for Security and Control 7.4 Technologies and Tools for Protecting Information Resources 7.5 Hands-on MIS Projects Business Problem-Solving Case: Are We Ready for Cyberwarfare? BOSTON CELTICS SCORE BIG POINTS AGAINST SPYWARE While the Boston Celtics were fighting for a spot in the playoffs several years ago, another fierce battle was being waged by its information systems. Jay Wessel, the team’s vice president of technology, was trying to score points against computer spyware. Wessel and his IT staff manage about 100 laptops issued to coaches and scouts, and sales, marketing, and finance employees, and these machines were being overwhelmed by malware (malicious software). Like any sports franchise, the Celtics are on the road...
Words: 21009 - Pages: 85
