The president of NDAS has just read a newspaper article explaining that the top security threats to companies aren't always from hackers trying to break in through the corporate firewall. In many cases, companies are more concerned about things such as internal employees and social engineering. After reading this article, he rushed down to Les Coone's office to understand what could happen to NDAS. Les has turned to you to prepare an analysis of NDAS security. While Les was in your office you mention that a security issue you recently learned about needs to be addressed. Five employees in the Accounts Payable office were recently given two weeks notice of their impending layoff due to the outsourcing of some of the Accounts Payable functions to another company. As you understand it, those five employees aren't happy with being released. Exercises
1. Prepare a report outlining the major security threats faced by NDAS. Be sure to identify those that you think are major threats and those that are minor threats.
2. Prepare a partial risk assessment for NDAS that includes their major assets, threats, and controls. You will need to make some reasonable assumptions.
3. Develop a set of security controls, for use in the NDAS main office and for its Web site, designed to control risks due to disruption, destruction, and disaster and unauthorized access.
4. Think about the accounts payable employees that are being laid off. What should be done to ensure that they don't do anything (such as steal customer data files, etc) before they leave the company. With their access to so much accounting data and other network access, list some of the main concerns that you may have. In addition, what will you suggest to mitigate these risks?