It is an accepted truth that without risk there can be no gain. Every individual and organization must take some risks to succeed. Risk management is not about avoiding risks, but about taking risks in a controlled environment. To do this, one must understand the risks, the triggers, and the consequences.

Instructions

Write a 3-4 page paper in which you:

1. Define risk management and information security clearly. Discuss how information security differs from information risk management.
2. Explain security policies and how they factor into risk management.
3. Describe at least two responsibilities for both IT and non-IT leaders in information risk management.
4. Describe how a risk management plan can be tailored to produce information and system-specific plans.
5. Use at least two quality resources in this assignment. Note: Wikipedia and similar websites do not qualify as quality resources. The Strayer University Library is a good source for resources.

Your assignment must follow these formatting requirements:

• This course requires the use of Strayer Writing Standards (SWS). The library is your home for SWS assistance, including citations and formatting. Please refer to the Library site for all support. Check with your professor for any additional instructions.

The specific course learning outcome associated with this assignment is:

• Assess how risk is addressed through system security policies, system-specific plans, and contingency plans.

IT544-2: Analyze the cybersecurity software development life cycle (SDLC).

Scenario

You recently took a position as a cybersecurity analyst for a small software company. The software company currently has three commercially available off-the-shelf software products that are sold to businesses and/or organizations (B2B). They can range from small companies to very large companies, including those in the Fortune 500. One of their products has been identified by CERT to have several vulnerabilities. Since this event occurred, the chief cybersecurity officer (CCSO) suspects that not enough security is built into the software development process used at the company. You have been asked by the CCSO to conduct a cyberattack surface analysis on one of their Web-based products in an effort to improve the software development process.

For the assignment, assume that the presentation layer resides on a dedicated server in the company’s DMZ. The other two layers of the software are behind the corporate firewall and can reside on one or two dedicated servers. The Web application is accessible from the Internet and is browser based. Firefox, Chrome, Internet Explorer, and Safari are the supported browsers.

Assignment Instructions

For Assignment purposes, select a multi-layered (presentation layer, business layer, and database layer) web-based open source project in place of the software company’s web-based product. In place of the open source project, if you are familiar with another web-based system that meets the requirements, then discuss using it with your instructor.

Examples of multi-layered open source projects/products include:

• Office Libre
• Facebook
• Mozilla Firefox
• GIMP (for web development)
• Audacity
• WordPress
• MySQL

You will conduct a cyberattack surface analysis on the system/application you selected. Focus your analysis from an external cyberattack point of view. It is not necessary to focus on end user cyberattacks (social engineering attacks, etc.).

• Define the cyberattack surface (including operating systems and web servers) by identifying and mapping the cyberattack vectors.
  • Categorize what was identified
  • Describe three use cases that involve the attack surfaces
• Create a graphic representation of the attack surface with labels (Use Visio or any other open source diagramming or drawing tool).
• Discuss how the attack surface can be reduced.

Your attack surface analysis can be done mentally and on paper or you can use an open source attack surface analyzer (OWASP’s Zap is one example).

Assignment Requirements:

• 3–4 pages of content (exclusive of title page and reference page), double-spaced in 12pt Times New Roman font, using correct APA formatting and including a title page and reference page
• At least one credible source.
• Correct spelling and grammar.
• Correct APA formatting.

You are the cybersecurity professional for Company A and are responsible for protecting the information of the company. Your roles include managing the company’s cybersecurity capabilities and tools, conducting vulnerability management, and assessing risk to sensitive information. Company A has recently purchased Company B and wants to merge both networks.

Executives of Company A have tasked you with making risk-based decisions on integrating Company B’s network with Company A’s existing network. Company B has provided its latest vulnerability scans, network diagrams, and existing cybersecurity capabilities and tools. As a deliverable to the executives, you will submit your recommendations for a secure network design that merges the two networks and allows remote access for employees of both companies in the form of a merger and implementation plan.

For this project, you will use the given scenario and the following supporting documents to complete your network merger and implementation plan:

•  “Company A Network Diagram”

•  “Company A Risk Analysis”

•  “Company B Network Diagram”

•  “Company B Vulnerability Report and Cybersecurity Tools”

Scenario Company A is a global company based in the United States that operates in the financial industry. Company A serves its customers with financial products, such as checking accounts, bank cards, and investment products. Company A has recently acquired Company B and needs to integrate with or remove similar capabilities and tools from Company B. Company B is smaller in size, has no dedicated cybersecurity professional role, and utilizes third-party support for infrastructure needs. Company B offers specialized software to medical providers and accepts credit cards as a payment option.  The executives of the newly merged company have expressed interest in integrating the use of the cloud to allow for scalability and redundancy. As the security professional of the merged networks, you are tasked with creating a secure network design that includes the use of zero trust principles and that utilizes both on-premises and cloud infrastructure. You also have been tasked with ensuring compliance with all regulatory requirements of the merged company, along with utilizing cloud-based technologies to provide security capabilities. Company executives have provided a budget of $50,000 in the first year to create a secure network design to utilize cloud-based services. Requirements Your submission must be your original work.
.    A.  Describe two current network security problems and two current infrastructure problems for each company, based on business requirements given in the scenario.
 B.  Analyze the given network diagram and vulnerability scan for both companies by doing the following:  1.  Describe two existing vulnerabilities for each company.  2.  Explain the impact, risk, and likelihood associated with each described vulnerability from part B1 as it relates to each company.  
C.  Create a network topology diagram with details of the proposed merged network requirements.  
D.  Identify the layer for all components in the topology diagram referencing the layers of the OSI model and TCP/IP protocol stack.  
E.  Explain the rationale for adding, deleting, or repurposing network components in the newly merged network topology diagram, including details of how each component addresses budgetary constraints.          F.   Explain two secure network design principles that are used in the proposed network topology diagram.  
G.  Explain how the proposed merged network topology diagram addresses two regulatory compliance requirements that are relevant to the newly merged company, including the following in your explanation:  •   the name of the regulatory compliance requirement  •   why the regulatory requirement is relevant to the newly merged company  •   how the proposed merged network topology diagram meets the regulatory requirement   
H.  Describe two emerging threats that are applicable to the merged organization, including the following in the description:  •   potential network security risks of implementing the topology  •   potential performance impacts on the merged network after implementation of the proposed design  •   how to manage the identified potential security risks  
I.  Summarize your recommendations for implementation of this proposed merged network based on the scenario and budgetary requirements, including the following in the summary:  •   a cost-benefit analysis for on-premises and cloud infrastructure solutions  •   a justification for your recommendations to implement the proposed secure merged network design  
J.  Acknowledge sources, using in-text citations and references, for content that is quoted, paraphrased, or summarized.   
K.  Demonstrate professional communication in the content and presentation of your submission.

Follow this rubric  :  A:BUSINESS REQUIREMENTS:The submission accurately describes 2 or more current network security problems and at 2 or more current infrastructure problems for each company and is aligned with the business requirements given in the scenario.  
B1:VULNERABILITIES : The submission accurately describes 2 or more existing vulnerabilities for each company. The vulnerabilities described are in alignment with the given network diagram and vulnerability scan.  
B2:IMPACT, RISK, LIKELIHOOD:  The submission explains the impact, risk, and likelihood associated with each described vulnerability from part B1 as it relates to each company. The explanation is complete and in alignment with the given network diagram and vulnerability scan.  
C:TOPOLOGY DIAGRAM: The network topology diagram with the details of the proposed merged network requirements is provided. The diagram is complete and meets the needs provided in the scenario. MAke a table under the topology for costs that include everything that we added and show that it stays under the 50k budget
D:TOPOLOGY COMPONENTS: The submission correctly identifies the layer for all components in the topology diagram referencing the layers of the OSI and TCP/IP protocol stack
E:RATIONALE : The submission explains the rationale for adding, deleting, or repurposing network components in the newly merged network topology diagram and includes the details of how each component addresses budgetary constraints. The explanation is in alignment with the given scenario.  F:SECURE NETWORK DESIGN PRINCIPLES :  The submission explains 2 or more secure network design principles that are used in the proposed network topology diagram. The explanation clearly names the secure network design principles being used and how each principle aligns with the proposed network topology diagram.  
G:REGULATORY COMPLIANCE : The submission accurately explains how the proposed merged network topology diagram addresses 2 or more regulatory compliance requirements and includes all of the listed components. The regulatory compliance requirements are relevant to the newly merged company.  
H:EMERGING THREATS : The submission accurately describes 2 or more emerging threats that are applicable to the newly merged organization and includes all the given points.
I:SUMMARY RECOMMENDATIONS: The submission summarizes the recommendations for implementation of the proposed merged network. The summary is logical and in alignment with the scenario and budgetary requirements and includes all listed specifications.  

Your responsibility is to aggregate the data to and showcase obvious trends in school performance.

Your final report should include each of the following:

District Summary

• Create a high level snapshot (in table form) of the district’s key metrics, including:
  • Total Schools
  • Total Students
  • Total Budget
  • Average Math Score
  • Average Reading Score
  • % Passing Math (The percentage of students that passed math.)
  • % Passing Reading (The percentage of students that passed reading.)
  • % Overall Passing (The percentage of students that passed math and reading.)

School Summary

• Create an overview table that summarizes key metrics about each school, including:
  • School Name
  • School Type
  • Total Students
  • Total School Budget
  • Per Student Budget
  • Average Math Score
  • Average Reading Score
  • % Passing Math (The percentage of students that passed math.)
  • % Passing Reading (The percentage of students that passed reading.)
  • % Overall Passing (The percentage of students that passed math and reading.)

Top Performing Schools (By % Overall Passing)

• Create a table that highlights the top 5 performing schools based on % Overall Passing. Include:
  • School Name
  • School Type
  • Total Students
  • Total School Budget
  • Per Student Budget
  • Average Math Score
  • Average Reading Score
  • % Passing Math (The percentage of students that passed math.)
  • % Passing Reading (The percentage of students that passed reading.)
  • % Overall Passing (The percentage of students that passed math and reading.)

Bottom Performing Schools (By % Overall Passing)

• Create a table that highlights the bottom 5 performing schools based on % Overall Passing. Include all of the same metrics as above.

Math Scores by Grade**

• Create a table that lists the average Math Score for students of each grade level (9th, 10th, 11th, 12th) at each school.

Reading Scores by Grade

• Create a table that lists the average Reading Score for students of each grade level (9th, 10th, 11th, 12th) at each school.

Scores by School Spending

• Create a table that breaks down school performances based on average Spending Ranges (Per Student). Use 4 reasonable bins to group school spending. Include in the table each of the following:
  • Average Math Score
  • Average Reading Score
  • % Passing Math (The percentage of students that passed math.)
  • % Passing Reading (The percentage of students that passed reading.)
  • % Overall Passing (The percentage of students that passed math and reading.)

Scores by School Size

• Repeat the above breakdown, but this time group schools based on a reasonable approximation of school size (Small, Medium, Large).

Scores by School Type

• Repeat the above breakdown, but this time group schools based on school type (Charter vs. District).

As final considerations:

• Use the pandas library and Jupyter Notebook.
• You must submit a link to your Jupyter Notebook with the viewable Data Frames.
• You must include a written description of at least two observable trends based on the data.
• See Example Solution for a reference on the expected format(attachment1).

Discuss at least four (4) best practices for IT infrastructure security policies in domains other than the User Domain. Pick one domain outside the user-domain to focus on.

 Address the following topics using your own words: 

 1. IT framework selection 

 2. When to modify existing policies that belong to other organizations versus creating your own policies from scratch 

3. Policy flexibility 

4. Cohesiveness 

5. Coherency 

6. Ownership 

Explain your answers.  If using content from internet please Cite them in APA format.