Assignment: Cybersecurity in Business & Industry
Project 1- e-Commerce Risk Analysis
Description
For this project, you will begin by researching a publicly traded company that engages in e-Commerce. You will then review the company's risk statements as published each year in the company's Annual Report to Investors (also published in the company's annual filing of SEC Form 10-K). After analyzing the company's e-Commerce operations and its risk statements about those activities, you will construct and document your own cybersecurity risk analysis which focuses upon the company's e-Commerce activities (including all supporting business processes).
A list of approved companies appears at the end of this file (see Table 2). If you wish to use acompany not on the approved list you must first obtain the approval of your instructor.
Note: before beginning this assignment, you should review NIST SP 800-30 R1: Guide for Conducting Risk Assessments. Pay special attention to Appendix D: "Threat Sources: Taxonomy of Threats Sources Capable of Initiating Threat Events" and Appendix H: "Impact: Effects of Threat Events on Organizations, Individuals, and the Nation."
Research Your Chosen Company
1. Review the company's website to learn about the products and services which it sells via e-Commerce.
2. Retrieve and review the Hoovers profile for the company. These profiles are written by professional analysts; pay close attention to the types of questions the analysts ask and answer in the company profile.
3. Use the search bar at the top of the "Search & Build a List" tab to find your chosen company.
4. The company profile web pages in the Hoovers database are interactive and have expanding menus / options (see figure below). You may find it helpful to use the "OneStop Report" button to generate a PDF version of the information. Select "Core" under categories (Available Fields: Company Summary, Contacts, Corporate Family, Corporate Overview, SWOT, and News). Click on the field names in the middle column to select them for your report.
5. After you have looked at the company website and the Hoovers report, Identify 3 or more additional sources of information about the company and how it operates in cyberspace. These can be news articles, data breach reports, etc.
6. Using the information obtained from your sources, identify the types of information and business operations which drive this company's need for cybersecurity products and services. (What needs to be protected?)
Analyze the Company's Risk Statements
1. Using the links from Table 1 (at the end of this file), download a copy of your selected company's most recent Annual Report to Investors from its Form 10-K filing with the United States Securities and Exchange Commission. (Note: the company is the author of its Form 10-K. Do not list the SEC as the author.)
2. Read and analyze the Risk Factors section in the company's report to investors (Item 1.A). This section is a professionally written risk analysis that has been written for a specific audience. Pay close attention to what the company includes as risk factors and how the writers chose to present this information.
3. Analyze the risk factors to determine which ones are related to e-Commerce / Internet operations or are otherwise affected by the use of information in digital form and Information Technology systems and infrastructures. Make a list that shows what information, digital assets, and/or business operations (processes) need to be protected from cyberattacks and/or cybercrime (including insiders and external threats) and the type of risk or threat that could affect those assets and processes.
Write
1. An introduction section which identifies the company being discussed and provides a brief introduction to the company including when it was founded and significant events in its history.
2. A business profile for the company. This information should include: headquarters location, key personnel, primary types of business activities and locations, major products or services sold by the company, major competitors, stock information (including ticker symbol or NASDAQ code), recent financial performance, and additional relevant information from the business profiles. (Use information from Hoovers and other authoritative sources)
3. An overviewof the company's e-Commerce operations which summarizes information obtained from its annual report, the Hoovers profile for the company, and other sources which you found in your research.
4. A separate section in which you describe this company's needs or requirements for cybersecurity. What information and/or business operations need to be protected? While your focus should be upon the company's e-Commerce activities, you should also address the back-office or supporting information and business processes required to deliver those e-commerce activities.
5. A separate section which provides a detailed summary of the identified risks and potential impacts upon the company's operations as a whole.What are the likely sources of threats or attacks for each type of information or business operation? (e.g. Protect customer information from disclosure or theft during online purchase transactions.). What are the possible impacts should these risks occur? You may present your summary in table format.
Project 2- Risk Management Strategy for an e-Commerce Company
Description
For this project, you will build upon the e-Commerce Risk Analysis performed in Project #2. For this project, you will construct a risk management strategy for your selected company which includes specific cybersecurity activities (as defined in the NIST Cybersecurity Framework Core) which will help the company mitigate the identified risks. Your strategy will include an "acquisition forecast" in which you identify and discuss the technologies, products, and services required to implement your recommended risk management strategy. (Note: you must use the same company as used in Project #2. You may expand upon your risk analysis if necessary.)
Develop an Executive Summary
Since this is a separate deliverable, you will need to begin by identifying the selected company and providing an executive summary of the e-Commerce Risk Analysis that you presented in Project #2.
Develop and Document theRisk Mitigation Strategy
For this section of your project, you must identify and document a risk mitigation strategy for 10 separate risks. Your risk mitigation strategies must utilize at least three of the five NIST Cybersecurity Framework (CSF) Core Functions.
1. Begin by copying Table 1 from this file into a new file (for your assignment submission). This table will become your Risk Profile Table. (Delete the example text.)
2. Next, convert your list of risk factors (from Project #2) into a "Risk Profile" Each risk factor should be listed as a separate risk item with its own row in your Risk Profile.(Add a row to your table for each identified risk - one per row). For this step, you will fill in the information for the first two columns (Risk ID and Risk).
3. Next, consult the NIST Cybersecurity Framework (see Table 2: Framework Core) to identify the cybersecurity activities which can be used to control / mitigate the identified risks. Add this information to each row in your table. Note: you should paraphrase the information for the "Risk Mitigation Strategy (description)" column and the "Implementation: Required Technologies, Products, or Services" column.
4. Complete the final two columns of the table by entering the exact function, category, and sub-category identifiers and descriptions as listed in NIST CSF Table 2.) See the example below.
Develop an "Acquisition Forecast"
To complete your work, summarize the technologies which you are recommending that the company acquire (purchase) in order to mitigate risks; these technologies MUST appear in your risk profile table. Your acquisition forecast should identify and fully discuss a minimum ofthree categories or types of cybersecurity products or services which this company will need to purchase in order to appropriately mitigate the identified risks.Remember to include information about potential vendors or suppliers including how you can identify and qualify appropriate sources of technologies, products, and services. This information provides the justification or rationale for your recommendations.
Note: "qualifying" a producer / manufacturer, vendor or seller refers to the due diligence processes required to investigate the supplier and ensure that the products, services, and technologies acquired from it will meet the company's needs and requirements. For cybersecurity related acquisitions, this many include testing the products and services to ensure that they can be trusted to deliver the required functionality and will not be a source of threats or harm.
Write
1. An executive summary which identifies the company being discussed and provides a brief introduction to the company including when it was founded and significant events in its history. This summary must also provide a high level overviewof the company's operations(reuse and adapt your narrative from Project #2) and the e-Commerce risks that the company must address and mitigate.
2. A separate section in which you present a Risk Management Profile. Begin with an introductory paragraph in which you summarize the risks and risk mitigation strategies. Your introduction should also explain the Risk Profile table (what is in it, how to use it).
3. Complete and then insert your Risk Profile Table at the end of this Risk Management Profile section. In-text citations are NOT required within the body of your Risk Profile Table but you must credit the sources of information used by listing / mentioning them in your introduction to this section.
4. A separate section in which you present your "Acquisition Forecast" in which you identify and discuss the products, services, and/or technologies which the company must purchase in the future to implement the recommended risk mitigation strategies. Remember to include information about potential vendors or suppliers including how you can identify and qualify appropriate sources of technologies, products, and services.
5. A closing section (Summary & Conclusions) which summarizes your risk management strategy and presents a compelling argument as to how your risk mitigation strategies (including the acquisition forecast) will reduce or control (mitigate) the identified "cyber" risks. Remember to address the five NIST Cybersecurity Framework Core Functions in your summation.
Format your assignment according to the following formatting requirements:
1. The answer should be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides.
2. The response also includes a cover page containing the title of the assignment, the student's name, the course title, and the date. The cover page is not included in the required page length.
3. Also include a reference page. The Citations and references should follow APA format. The reference page is not included in the required page length.
Attachment:- Assignment-Cybersecurity-in-Business-and-Industry.rar