Scribd Logo
Upload

Welcome to Scribd!

  • 103 views

    Lab4 IAA202

    Uploaded by

    Đào Mạnh Công
    This document outlines a qualitative risk assessment performed on an IT infrastructure across seven domains. Risks, threats and vulnerabilities were identified and assigned a risk impact factor of critical, major or minor. Critical risks impact compliance and liability, major risks impact security of assets and infrastructure, and minor risks impact productivity. The assessment was then prioritized by domain with critical issues ranked 1, major as 2 and minor as 3. Recommendations will be provided to executive management on next steps to mitigate highest priority risks.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Lab4 IAA202

    Uploaded by

    Đào Mạnh Công
    103 views5 pages
    This document outlines a qualitative risk assessment performed on an IT infrastructure across seven domains. Risks, threats and vulnerabilities were identified and assigned a risk impact factor of critical, major or minor. Critical risks impact compliance and liability, major risks impact security of assets and infrastructure, and minor risks impact productivity. The assessment was then prioritized by domain with critical issues ranked 1, major as 2 and minor as 3. Recommendations will be provided to executive management on next steps to mitigate highest priority risks.

    Original Description:

    Perform a Qualitative Risk Assessment for an IT Infrastructure

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document outlines a qualitative risk assessment performed on an IT infrastructure across seven domains. Risks, threats and vulnerabilities were identified and assigned a risk impact factor of critical, major or minor. Critical risks impact compliance and liability, major risks impact security of assets and infrastructure, and minor risks impact productivity. The assessment was then prioritized by domain with critical issues ranked 1, major as 2 and minor as 3. Recommendations will be provided to executive management on next steps to mitigate highest priority risks.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    103 views5 pages

    Lab4 IAA202

    Uploaded by

    Đào Mạnh Công
    This document outlines a qualitative risk assessment performed on an IT infrastructure across seven domains. Risks, threats and vulnerabilities were identified and assigned a risk impact factor of critical, major or minor. Critical risks impact compliance and liability, major risks impact security of assets and infrastructure, and minor risks impact productivity. The assessment was then prioritized by domain with critical issues ranked 1, major as 2 and minor as 3. Recommendations will be provided to executive management on next steps to mitigate highest priority risks.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 5

    Lab #4: Perform a Qualitative Risk Assessment for an IT

    Infrastructure
    Risk Management in Information
    Course Name:
    Systems (IAA202)
    Nguyễn Trí Vương - HE161634
    Student Name:
    Đào Mạnh Công - HE161422

    Instructor Name Hồ Kim Cường


    Lab Due Date

    Overview
    The following risks, threats, and vulnerabilities were found in an IT infrastructure. Your
    Instructor will assign you one of four different scenarios and vertical industries each of
    which is under a unique compliance law.
    1. Scenario/Vertical Industry:
    a. Healthcare provider under HIPPA compliance law
    b. Regional bank under GLBA compliance law
    c. Nationwide retailer under PCI DSS standard requirements
    d. Higher-education institution under FERPA compliance law
    2. Given the list, perform a qualitative risk assessment by assigning a risk impact/risk
    factor to each of identified risks, threats, and vulnerabilities throughout the seven
    domains of a typical IT infrastructure that the risk, threat, or vulnerability resides.

    Risk – Threat – Primary Domain


    Risk Impact/Factor
    Vulnerability Impacted
    Unauthorized access from
    LAN-to-WAN Critical
    public Internet
    User destroys data in
    application and deletes all Systems/Application Critical
    files
    Hacker penetrates your IT LAN-to-WAN Critical
    infrastructure and gains
    access to your internal
    network
    Intra-office employee
    User Minor
    romance gone bad
    Fire destroys primary data
    Systems/Application Major
    center
    Service provider SLA is
    WAN Minor
    not achieved
    Workstation OS has a
    known software Workstation Major
    vulnerability
    Unauthorized access to
    organization owned Workstation Major
    Workstations
    Loss of production data Systems/Application Minor
    Denial of service attack on
    organization DMZ and LAN-to-WAN Major
    e-mail server
    Remote communications
    Remote Access Major
    from home office
    LAN server OS has a
    known software LAN Critical
    vulnerability
    User downloads and clicks
    User Critical
    on an unknown
    Workstation browser has
    Workstation Major
    software vulnerability
    Mobile employee needs
    secure browser access to User Minor
    sales order entry system
    Service provider has a
    WAN Minor
    major network outage
    Weak ingress/egress traffic
    filtering degrades LAN-to-WAN Minor
    Performance
    User inserts CDs and USB
    hard drives with personal
    photos, music, and videos User Minor
    on organization owned
    computers
    VPN tunneling between
    remote computer and Remote Access Major
    ingress/egress router
    WLAN access points are
    needed for LAN
    LAN Minor
    connectivity within a
    warehouse
    Need to prevent rogue
    users from unauthorized LAN Major
    WLAN access
    DoS/DDoS attack from the
    WAN Major
    WAN/Internet

    3. For each of the identified risks, threats, and vulnerabilities, prioritize them by listing a
    “1”, “2”, and “3” next to each risk, threat, vulnerability found within each of the seven
    domains of a typical IT infrastructure. “1” = Critical, “2” = Major, “3” = Minor. Define
    the following qualitative risk impact/risk factor metrics:

    “1” Critical – a risk, threat, or vulnerability that impacts compliance (i.e., privacy law
    requirement for securing privacy data and implementing proper security controls, etc.)
    and places the organization in a position of increased liability.
    “2” Major – a risk, threat, or vulnerability that impacts the C-I-A of an organization’s
    intellectual property assets and IT infrastructure.
    “3”Minor – a risk, threat, or vulnerability that can impact user or employee productivity
    or availability of the IT infrastructure.

    User Domain Risk Impacts: 1, 2, 3


    Workstation Domain Risk Impacts: 2, 3
    LAN Domain Risk Impacts: 1, 2
    LAN-to-WAN Domain Risk Impacts: 1, 2, 3
    WAN Domain Risk Impacts: 2, 3
    Remote Access Domain Risk Impacts: 2, 3
    Systems/Applications Domain Risk Impacts: 1, 2
    4. Craft an executive summary for management using the following 4-paragraph format.
    The executive summary must address the following topics:
    - Paragraph #1: Summary of findings: risks, threats, and vulnerabilities found throughout
    the seven domains of a typical IT infrastructure
    - Paragraph #2: Approach and prioritization of critical, major, minor risk assessment
    elements
    - Paragraph #3: Risk assessment and risk impact summary to the seven domains of a
    typical IT infrastructure
    - Paragraph #4: Recommendations and next steps for executive management

    Lab #4: Assessment Worksheet


    Overview
    Answer the following Lab #4 – Assessment Worksheet questions pertaining to your
    qualitative IT risk assessment you performed.
    Lab Assessment Questions

    1. What is the goal or objective of an IT risk assessment?


    - To mitigate risks to prevent security incidents and to define how the
    risk will be managed, controlled, and monitored.

    2. Why is it difficult to conduct a qualitative risk assessment for an IT infrastructure?


    - Because a qualitative assessment is based on opinion than actual fact,
    and IT risk assessments need to be based on a quantitative analysis.

    3. What was your rationale in assigning “1” risk impact/ risk factor value of “Critical” for
    an identified risk, threat, or vulnerability?
    - The critical needs to be mitigated immediately.
    4. When you assembled all of the “1” and “2” and “3” risk impact/risk factor values to the
    identified risks, threats, and vulnerabilities, how did you prioritize the “1”, “2”, and “3”
    risk elements? What would you say to executive management regarding your final
    recommended prioritization?
    - The risk impact/risk factor which is “1” or “2” need to be mitigated
    immediately, “3” can be mitigated after “1” and “2” have done.

    5. Identify a risk mitigation solution for each of the following risk factors:
    - User downloads and clicks on an unknown e-mail attachment – Restrict user access and
    set it up that a user has to get authorization for downloads.

    - Workstation OS has a known software vulnerability – Patch or update software.

    - Need to prevent eavesdropping on WLAN due to customer privacy data access –


    Increase WLAN security using WPA2 and AES encryption.

    - Weak ingress/egress traffic filtering degrades performance – Strengthen firewall


    filtering.

    - DoS/DDoS attack from the WAN/Internet – Strengthen firewall security, install IPS and
    IDS system to the infrastructure

    - Remote access from home office – Make sure the VPN is in place and secure.

    - Production server corrupts database – Remote server.

    You might also like