Scribd Logo
Upload

Welcome to Scribd!

  • 177 views

    Võ Minh Khánh - SE140781 Trần Đăng Khoa - SE140934

    Uploaded by

    Vo Minh Khanh (K14 HCM)
    This document lists risks, threats, and vulnerabilities commonly found in an IT infrastructure along with the policy definitions required to address them. It includes risks such as unauthorized access from the public internet, data or file deletion by users, hacking, workplace conflicts, natural disasters, software vulnerabilities, and more. For each risk listed, it provides the specific policy definition needed such as access control policies, acceptable use policies, business continuity plans, vulnerability management policies, and other security policies.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Võ Minh Khánh - SE140781 Trần Đăng Khoa - SE140934

    Uploaded by

    Vo Minh Khanh (K14 HCM)
    177 views6 pages
    This document lists risks, threats, and vulnerabilities commonly found in an IT infrastructure along with the policy definitions required to address them. It includes risks such as unauthorized access from the public internet, data or file deletion by users, hacking, workplace conflicts, natural disasters, software vulnerabilities, and more. For each risk listed, it provides the specific policy definition needed such as access control policies, acceptable use policies, business continuity plans, vulnerability management policies, and other security policies.

    Original Title

    LAB3_GROUP4_IAP301

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document lists risks, threats, and vulnerabilities commonly found in an IT infrastructure along with the policy definitions required to address them. It includes risks such as unauthorized access from the public internet, data or file deletion by users, hacking, workplace conflicts, natural disasters, software vulnerabilities, and more. For each risk listed, it provides the specific policy definition needed such as access control policies, acceptable use policies, business continuity plans, vulnerability management policies, and other security policies.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    177 views6 pages

    Võ Minh Khánh - SE140781 Trần Đăng Khoa - SE140934

    Uploaded by

    Vo Minh Khanh (K14 HCM)
    This document lists risks, threats, and vulnerabilities commonly found in an IT infrastructure along with the policy definitions required to address them. It includes risks such as unauthorized access from the public internet, data or file deletion by users, hacking, workplace conflicts, natural disasters, software vulnerabilities, and more. For each risk listed, it provides the specific policy definition needed such as access control policies, acceptable use policies, business continuity plans, vulnerability management policies, and other security policies.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    You are on page 1of 6
    At a glance
    Powered by AI
    The document discusses various IT security policies and frameworks including access control, data backup/recovery, vulnerability management, and security awareness training.

    A policy definition usually contains purpose, scope, roles and responsibilities, and compliance.

    Leadership, resources, and communication are needed to ensure successful policy implementation.

    Võ Minh Khánh – SE140781

    Trần Đăng Khoa – SE140934


    Nguyễn Quốc Bửu – SE140936

    Part B – List of Risks, Threats, and Vulnerabilities Commonly Found in an IT


    Infrastructure
    Risk - Threat - Vulnerability Policy Definition Required
    Unauthorized access from public Internet Access Control Policy Definition
    User destroys data in application and deletes Acceptable Use Policy
    all files
    Hacker penetrates your IT infrastructure Access Control Policy Definition
    and gains access to your internal network
    Intra-office employee romance gone bad Business Continuity – Business Impact
    Analysis (BIA) Policy Definition
    Fire destroys primary data center Business Continuity & Disaster Recovery
    Policy Definition
    Communication circuit outages Business Continuity & Disaster Recovery
    Policy Definition
    Workstation OS has a known software Vulnerability Management & Vulnerability
    vulnerability Window Policy Definition
    Unauthorized access to organization-owned Access Control Policy Definition
    Workstations
    Loss of production data Production Data Back-up Policy Definition
    Denial of service attack on organization e- Access Control Policy Definition
    mail
    Server
    Remote communications from home office Remote Access Policy Definition
    LAN server OS has a known software Vulnerability Management & Vulnerability
    vulnerability Window Policy Definition
    User downloads an unknown e –mail Mandated Security Awareness Training
    attachment Policy Definition
    Workstation browser has software Vulnerability Management & Vulnerability
    vulnerability Window Policy Definition
    Service provider has a major network outage Business Continuity – Business Impact
    Analysis (BIA) Policy Definition
    Weak ingress/egress traffic filtering degrades Internet Ingress/Egress Traffic Policy
    Performance Definition
    User inserts CDs and USB hard drives Mandated Security Awareness Training
    with personal photos, music, and videos on Policy Definition, Acceptable Use Policy
    organization owned computers
    VPN tunneling between remote computer Internet Ingress/Egress Traffic Policy
    and ingress/egress router Definition
    WLAN access points are needed for LAN Acceptable Use Policy
    connectivity within a warehouse
    Need to prevent rogue users from Access Control Policy Definition
    unauthorized WLAN access
    Lab Assessment Questions & Answers:
    1. A policy definition usually contains what four major parts or elements?
    - Distributive policies
    Distributive policy a policy that collect payments or resources broadly but concentrates direct
    benefits on relatively few. free-market economics a school of thought that believes the forces of
    supply and demand, working without any government intervention, are the most effective way for
    markets to operate.

    - Regulatory policies
    Regulatory policy is formulated by governments to impose controls and restrictions on certain
    specific activities or behavior. Regulation is not only about rules of governing but also a concept in
    governance.

    - Constituent policies
    Constituent policies are concerned with the establishment of government structure, establishment of
    rules or procedures for the conduct of government, rules that distribute or divide power and
    jurisdiction within the present and future government policies might be made.

    - Redistributive policies
    Redistributive policy a policy in which costs are born by a relatively small number of groups or
    individuals, but benefits are expected to be enjoyed by a different group in society.

    2. In order to effectively implement a policy framework, what three organizational elements are
    absolutely needed to ensure successful implementation?

    People, policy and technologies.

    3.Which policy is the most important one to implement to separate employer from employee?
    Which is the most challenging to implement successfully?

    The most challenging to implement successfully is the policy related to people because user
    domain is known as the most vulnerable domain. The most important one would also be the ones
    related to people wtih the same reason.

    4. Which domain requires stringent access controls and encryption for connectivity to the
    corporate resources from home? What policy definition is needed for this domain?
    The remote access domain definitely the one domain that we need to controls controls and
    encryption for connectivity to the corporate resources from home.

    5. Which domains need software vulnerability management & vulnerability window policy
    definitions to mitigate risk from software vulnerabilities?

    The System/ Application domain, LAN to WAN domain, workstaion domain.

    6. Which domain requires AUPs to minimize unnecessary User-initiated Internet traffic and
    awareness of the proper use of organization-owned IT assets?

    Workstaion domain, WWAN domain

    7. What policy definition can help remind employees within the User Domain about on-going
    acceptable use and unacceptable use?

    Regulatory policies.

    8. What policy definition is required to restrict and prevent unauthorized access to organization
    owned IT systems and applications?

    Constituent policies

    9. What is the relationship between an Encryption Policy Definition and a Data Classification
    Standard?
    Encryption Policy Definition: The goal of an encryption policy is to encrypt data at the requisite
    times. For instance, IPSec and SSL provide encryption when data travels across a network but do
    little to protect data stored on disk or in a database.
    Data Classification Standard: The UNSW Data Classification Standard is a framework for
    assessing data sensitivity, measured by the adverse business impact a breach of the data would
    have upon the University.

    10. What policy definition is needed to minimize data loss?


    Data loss prevention (DLP) 

    11. Explain the relationship between the policy-standard-procedure-guideline


    structure and how this should be postured to the employees and authorized users.

    Policy: Policies are formal statements produced and supported by senior management.
    Policies are enforceable and mandatory, which means there are consequences if they're not
    followed.
    Standard: Standards are mandatory courses of action or rules that give formal policies support
    and direction.
    This makes sure everything and everyone is consistent in their performance across the
    organization.
    Procedure: Procedures are detailed step-by-step instructions to achieve a given goal or
    mandate.
    They often go hand-in-hand with policies and guidelines.
    Guidelines: Guidelines are recommendations to users when specific standards do not
    apply.
    Guideline gives the reader guidance and additional information to help the audience

    12. Why should an organization have a remote access policy even if they already have an
    Acceptable Use Policy (AUP) for employees?

    A remote access policy contains everything that an Acceptable Use Policy states, as well as
    additions specific to remote access. Alongside with defining rules and regulations with the use of
    company assets, network connections, and organization resources, the remote access policy
    further addresses issues specific to remote connections and access.
    13. What security controls can be implemented on your e-mail system to help prevent rogue or
    malicious software disguised as URL links or e-mail attachments from attacking the Workstation
    Domain? What kind of policy definition should this be include in?

    Spam filters, dynamic code analysis tools like FireEye that analyze email attachments,
    blacklisting known malicious domains and senders, blackholing malicious domain redirects, and
    security awareness training to help identify spam and malicious links and attachments, are some
    of the security controls that an organization can employ to protect their email systems from
    phishing attempts, malicious links, and virus attachments.

    14. Why should an organization have annual security awareness training that includes an
    overview of the organization’s policies?

    Having an annual security awareness training that includes a review of the organization’s latest
    version of the policies is an effective way of ensuring every employee is aware of the current
    policies and cannot cite ignorance as a reason for violating them.

    15. What is the purpose of defining of a framework for IT security policies?

    The purpose of defining a framework for IT security policies is to have a defined structure that
    shows what the gaps in the policy are and how it can be filled. Having a proper framework will
    show what adjustments are needed to strengthen the policies.

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy