PROJECT 3 - ASSESSING INFORMATION SYSTEM VULNERABILITY AND RISK MITIGATION -
Intro video on the deliverables is here https://youtu.be/rStxKMeGXAI
Please select part of your references from this below.
https://resources.sei.cmu.edu/library/
The deliverables for this project are as follows:
Security Assessment Report (SAR): This should be an 8-page double-spaced Word document with citations in APA format. The page count does not include figures, diagrams, tables, or citations.
2. Risk Assessment Report (RAR): This report should be a 5-page double-spaced Word document with citations in APA format. The page count does not include figures, diagrams, tables, or citations.
Please select part of your references from this below.
https://resources.sei.cmu.edu/library/
Pick an organization of your choice (pick from any sector, be creative)
1. Security Assessment Report (SAR) with the following sections: please pay attention to details of the ENTIRE requirements (use figures, tables and diagrams where applicable)
· Organizational Background
Describe the background of the organization you have picked
Purpose
Describe purpose of the assessment (refer to the incident of OPM below in the transcript)
Organizational structure
o Describe the organizational structure, the network system description, and a diagram of the organization. (Please insert this diagram) Include LAN, WAN, and systems in diagram format (use the OPM systems model of LAN side networks), the intra-network, and WAN side networks, the Internet. Identify the boundaries that separate the inner networks from the outside networks.
o include a description of how these platforms are implemented in your organization: common computing platforms, cloud computing, distributed computing, centralized computing, secure programming fundamentals. (cite reference)
o What insider threats are a risk to your organization
o differentiate between the external threats to the system and the insider threats. Identify where these threats can occur in the previously created diagrams. (cite reference)
o Define threat intelligence, and explain what kind of threat intelligence is known about the OPM breach. Relate the OPM threat intelligence to your fictitious organization. How likely is it that a similar attack will occur at your organization?(cite reference)
Scope
Describe the scope of the assessment
Methodology (cite references)
o Use a suite of security tools, techniques, and procedures that can be used to assess the security posture of your organization's network in a SAR.
o identify the security issues in your fictitious organization's networks. You have already used password cracking tools to crack weak and vulnerable passwords.
o Provide an analysis of the strength of passwords used by the employees in your organization. Are weak passwords a security issue for your organization?
o examine security tool resources on firewalls and auditing-RDBMS related to the use of the Relational Database Management System (i.e., the database system and data) RDBMS. Also review these resources related to access control.
o Determine the role of firewalls and encryption, and auditing - RDBMS that could assist in protecting information and monitoring the confidentiality, integrity, and availability of the information in the information systems.
o Reflect any weaknesses found in the network and information system diagrams previously created, as well as in the developing SAR.
o Which of the following types of threats and attack techniques are a risk to your organization; IP address spoofing/cache poisoning attacks, denial of service attacks (DoS), packet analysis/sniffing, session hijacking attacks, distributed denial of service attacks
o In identifying the different threats:
1. Identify the potential hacking actors of these threat attacks on vulnerabilities in networks and information systems and the types of remediation and mitigation techniques available in your industry, and for your organization.
2. Identify the purpose and function of firewalls for organization network systems, and how they address the threats and vulnerabilities you have identified.
3. Also discuss the value of using access control, database transaction and firewall log files.
4. Identify the purpose and function of encryption, as it relates to files and databases and other information assets on the organization's networks.
5. Further analyze the packet capture for network performance, behavior, and any suspicious source and destination addresses on the networks.
6. In the previously created Wireshark files, identify if any databases had been accessed. What are the IP addresses associated with that activity? Include this information in the SAR.
o Provide possible nmap portscan findings in the SAR deliverable.
Provide analyses of the scans and any recommendation for remediation
Identify any suspicious activity and formulate the steps in an incidence response that could have been, or should be, enacted.
Include the responsible parties that would provide that incidence response and any follow-up activity. Include this in the SAR.
Please note that some scanning tools are designed to be undetectable.
While running the scan and observing network activity with Wireshark, attempt to determine the detection of the scan in progress. If you cannot identify the scan as it is occurring, indicate this in your SAR.
Data
Results
Compare results of wireshark and nmap in a general sense
o INCLUDE lab report on wireshark and nmap as part of the SAR.
o Review the information captured in these two links message and protocols and Transmission Control Protocol/Internet Protocol (TCP/IP),
o identify any security communication, message and protocols, or security data transport methods used such as (TCP/IP), SSL, and others. Make note and mention in your reports.
Findings
o Describe the findings in the report to include: weak authentication mechanisms; lack of a plan for life-cycle management of the information systems; lack of a configuration management and change management plan; lack of inventory of systems, servers, databases, and network devices; lack of mature vulnerability scanning tools; lack of valid authorizations for many systems, and lack of plans of action to remedy the findings of previous audits.
o Describe some critical security practices, such as lack of diligence to security controls and management of changes to the information systems infrastructure were cited as contributors to the massive data breach in the OPM Office of the Inspector General's (OIG) Final Audit Report, which can be found in open source searches.
o Describe Enterprise Architecture: Knowledge of architectural methodologies used in the design and development of information systems, including the physical structure of a system's internal operations and interactions with other systems and knowledge of standards
o Describe Technology Awareness: Explore and address cybersecurity concerns, promote awareness, best practice, and emerging technology
o Describe Risk Management : Knowledge of methods and tools used for risk management and mitigation of risk
o Describe Incident Detection: Demonstrate the abilities to detect, identify, and resolve host and network intrusion incidents.
o Describe Incident Classification: Possess knowledge and skills to categorize, characterize, and prioritize an incident as well as to handle relevant digital evidence appropriately
2. Risk Assessment Report (RAR) please review requirements and use figures, tables and diagrams where applicable
· Identify and include information on the threats, vulnerabilities, risks, likelihood of exploitation of security weaknesses, level of impact it would have on the organization and suggested remediation. (cite reference)
· Include impact assessments for exploitation of security weaknesses, remediation, and cost/benefit analyses of remediation. (cite reference)
· devise and include a high-level plan of action with interim milestones (POAM), in a system methodology, to remedy your findings. (cite reference)
· Summarize the results you obtained from the vulnerability assessment tools (i.e., MBSA and OpenVas) in your report.
· Include the OPM OIG Final Audit Report findings as a possible source for potential mitigations or possible methods to remediate vulnerabilities (cite reference)
Notes start here:
You have studied the OPM OIG report and found that the hackers were able to gain access through compromised credentials.
The security breach could have been prevented, if the Office of Personnel Management, or OPM, had abided by previous auditing reports and security findings.
In addition, access to the databases could have been prevented by implementing various encryption schemas and could have been identified after running regularly scheduled scans of the systems.
The security posture of the information systems infrastructure of an organization should be regularly monitored and assessed (including software, hardware, firmware components, governance policies, and implementation of security controls).
The monitoring and assessment of the infrastructure and its components, policies, and processes should also account for changes and new procurements that are sure to follow in order to stay in step with ever-changing information system technologies.
Notes end here:
Prepare a Security Assessment Report (SAR) with the following sections:
Purpose
Organization
Scope
Methodology
Data
Results
Findings
The final SAR does not have to stay within this framework, and can be designed to fulfill the goal of the security assessment.
Prepare a Risk Assessment Report (RAR) with information on the threats, vulnerabilities, likelihood of exploitation of security weaknesses, impact assessments for exploitation of security weaknesses, remediation, and cost/benefit analyses of remediation.
Devise a high-level plan of action with interim milestones (POAM), in a system methodology, to remedy your findings. Include this high-level plan in the RAR. Summarize the results you obtained from the vulnerability assessment tools (i.e., MBSA and OpenVas) in your report.
1.1: Organize document or presentation in a manner that promotes understanding and meets the requirements of the assignment.
1.2: Develop coherent paragraphs or points to be internally unified and function as part of the whole document or presentation.
1.3: Provide sufficient, correctly cited support that substantiates the writer's ideas.
1.4: Tailor communications to the audience.
1.5: Use sentence structure appropriate to the task, message and audience.
1.6: Follow conventions of Standard Written English.
5.2 Enterprise Architecture: Knowledge of architectural methodologies used in the design and development of information systems, including the physical structure of a system's internal operations and interactions with other systems and knowledge of stan
5.6: Technology Awareness: Explore and address cybersecurity concerns, promote awareness, best practice, and emerging technology
7.3: Risk Management : Knowledge of methods and tools used for risk management and mitigation of risk
8.1: Incident Detection: Demonstrate the abilities to detect, identify, and resolve host and network intrusion incidents.
8.2: Incident Classification: Possess knowledge and skills to categorize, characterize, and prioritize an incident as well as to handle relevant digital evidence appropriately.
VIDEO Transcript
You are an Information Assurance Management Officer, IAMO, at an organization of your choosing. One morning, as you're getting ready for work, you see an email from Karen, your manager. She asks you to come to her office as soon as you get in. When you arrive to your work, you head straight to Karen's office. "Sorry for the impromptu meeting," she says, "but we have a bit of an emergency. There's been a security breach at the Office of Personnel Management."
We don't know how this happened, but we need to make sure it doesn't happen again, says Karen. You'll be receiving an email with more information on the security breach. Use this info to assess the information system vulnerabilities of the Office of Personnel Management.
At your desk, you open Karen's email. She's given you an OPM report from the Office of the Inspector General, or OIG. You have studied the OPM OIG report and found that the hackers were able to gain access through compromised credentials.
The security breach could have been prevented, if the Office of Personnel Management, or OPM, had abided by previous auditing reports and security findings. In addition, access to the databases could have been prevented by implementing various encryption schemas and could have been identified after running regularly scheduled scans of the systems.
Karen and the rest of the leadership team want you to compile your findings into a Security Assessment Report or SAR. You will also create a Risk Assessment Report, or RAR, in which you identify threats, vulnerabilities, risks, and likelihood of exploitation and suggested remediation.
END OF TRANSCRIPT
The security posture of the information systems infrastructure of an organization should be regularly monitored and assessed (including software, hardware, firmware components, governance policies, and implementation of security controls).
The monitoring and assessment of the infrastructure and its components, policies, and processes should also account for changes and new procurements that are sure to follow in order to stay in step with ever-changing information system technologies.
The data breach at the Office of Personnel Management (OPM) is one of the largest in US government history. It provides a series of lessons learned for other organizations in industry and the public sector. Some critical security practices, such as lack of diligence to security controls and management of changes to the information systems infrastructure were cited as contributors to the massive data breach in the OPM Office of the Inspector General's (OIG) Final Audit Report, which can be found in open source searches.
Some of the findings in the report include: weak authentication mechanisms; lack of a plan for life-cycle management of the information systems; lack of a configuration management and change management plan; lack of inventory of systems, servers, databases, and network devices; lack of mature vulnerability scanning tools; lack of valid authorizations for many systems, and lack of plans of action to remedy the findings of previous audits.
The breach ultimately resulted in removal of OPM's top leadership. The impact of the breach on the livelihoods of millions of people is ongoing and may never be fully known. There is a critical need for security programs that can assess vulnerabilities and provide mitigations.
There are 10 steps that will lead you through this project. You should complete Project 3 during Weeks 2-5. After beginning with the workplace scenario, continue to Step 1: "Organizational Background."
When you submit your project, your work will be evaluated using the competencies listed below. You can use the list below to self-check your work before submission.
1.1: Organize document or presentation in a manner that promotes understanding and meets the requirements of the assignment.
1.2: Develop coherent paragraphs or points to be internally unified and function as part of the whole document or presentation.
1.3: Provide sufficient, correctly cited support that substantiates the writer's ideas.
1.4: Tailor communications to the audience.
1.5: Use sentence structure appropriate to the task, message and audience.
1.6: Follow conventions of Standard Written English.
5.2 Enterprise Architecture: Knowledge of architectural methodologies used in the design and development of information systems, including the physical structure of a system's internal operations and interactions with other systems and knowledge of stan
5.6: Technology Awareness: Explore and address cybersecurity concerns, promote awareness, best practice, and emerging technology
7.3: Risk Management : Knowledge of methods and tools used for risk management and mitigation of risk
8.1: Incident Detection: Demonstrate the abilities to detect, identify, and resolve host and network intrusion incidents.
8.2: Incident Classification: Possess knowledge and skills to categorize, characterize, and prioritize an incident as well as to handle relevant digital evidence appropriately.
Step 1 Organizational Background
Describe the background of your organization, including the purpose, organizational structure, the network system description, and a diagram of the organization. Include LAN, WAN, and systems in diagram format (use the OPM systems model of LAN side networks), the intra-network, and WAN side networks, the inter-net. Identify the boundaries that separate the inner networks from the outside networks.
Take time to click on and read about the following computing platforms available for networks, then include a description of how these platforms are implemented in your organization:
common computing platforms
cloud computing
distributed computing
centralized computing
secure programming fundamentals
This information can be fictitious, or modeled from existing organizations. Be sure to cite references.