CMP73001-Cybersecurity Management

Task Description

You are hired by Advanced Medicos Limited (AML), a healthcare product sell company, as a cybersecurity consultant to help in security management and to address the contemporary and emerging risks from the cyber threats the company is facing. AML is providing a platform for Australian customers to sell their product online. The vision of the company is to be among the top 5 nation-wide. The board from the advice by Chief Information Officer (CIO) and Chief Information Security Officer (CISO) has concluded that they should get to point that the key services such as web portal should be able to recover from major incidents in less than 20 minutes while other services can be up and running in less than 1 hour. In case of a disaster, they should be able to have the Web portal and payroll system fully functional in less than 2 days.

The company is a new company which is growing rapidly. While the company uses its database server to store the information of its customers’ private data, credit card info, etc. it has a poordesigned network with a low level of security. As the company is responsible for the privacy and the security of customer personal info, credit card details, the security of payment transactions, etc. they have decided to improve their information security. Therefore, they have hired you to do the following task: 

Risk assessment exercise: perform a full cyber risk assessment exercise for this company and document the outcomes.

Existing IT infrastructure of AML:

- Office 365 Emails Hosting

- 2 Web server providing web services and payment options

- A physical database server storing customer information

- DHCP and DNS servers

- Servers located in a server room accessible by all staff

- There is no virtual/cloud storage

- The backup files are stored on a single computer connected to the internal network

- Two 24-port Cisco Catalyst switches (1Gbps ports)

- Switches are access layer switches

- ADSL router

- 40 PCs with outdated antivirus

- The operating systems used in the company are Windows 2012 server and Windows 10

- Windows Firewalls are on

- No security configuration on routers and switches

- Telnet connection is used by IT people to remotely check the configuration of the network devices. Therefore, there is no encryption in remote access.

- Two wireless access points

- Wireless security is WPA

- 10 Voice over IP phones

- Servers located in a server room accessible by all staff

- There is no virtual/cloud storage

- The backup files are stored on a single computer connected to the internal network

- There are 40 staff including three IT people (IT staff are responsible to look after internet connection, network devices, Wi-Fi, Voice over IP service, LAN, computers, servers, hardware and software, and video conference facilities).

- All staff and equipment are on a single floor.

- The roles and responsibilities of people who are responsible for information security management are not clear and they are not documented. All IT staff help in information security management. 

For this assignment, you need to write a report to the CEO of the company and answer a number of questions. You should also identify assets, perform risk assessment, and propose solutions to mitigate risks. Your answer should be submitted in PDF/DOC files. 

Assignment 

Risk assessment exercise: perform a full cyber risk assessment exercise for AML and document the outcome. 

Task 1: Identify and manage asset 

1.1 To perform a risk assessment for this company, you should first identify all information assets and their business values. This is necessary because unidentified assets are not considered in risk assessment. In this question, you need to identify information assets based on your judgment and then perform the asset classification. You should classify information assets as different categories of assets which might need different protection based on their sensitivity and their value. Make a table for your task 1 and add the following information in your table:

a. provide a list of assets (at least 10 assets should be identified) and provide a meaningful description for the assets e.g. what is it used for, and what is included etc.

b. determine the asset location and ownership, assign a unique ID for the asset. Each id should give some hint about the asset. For instance, HW.01 can be interpreted as Hardware Asset number 1.

c. classify the identified assets based on their sensitivity. The identified classes should be based on your understanding and experience of each asset. You need to do some research and find at least three common classes of information assets. Create a Weighting Factor Analysis (WFA) to rank the identified assets. 

1.2 Explain how information security governance can help AML to have efficient asset management.

1.3 To improve the level of cybersecurity in AML, you should develop some security policies. The policies should cover different assets like people, technology, access control, etc. The links below give you some examples of information security policies. For this question, at least 5 policies should be provided. It is expected that you first create your Enterprise security or enterprise information policy. 

Task 2: Vulnerability management and risk management 

2.1 Do some research about different steps of Enterprise Risk Management by ISO framework and briefly explain each step.

2.2 Identify vulnerabilities in the company assets and their threats. This information should be shown in a table called vulnerability assessment table (TVA worksheet). One extra column should be added for brief vulnerability analysis.

2.3 Now, you are responsible to develop a risk management strategy to mitigate the existing risks to an acceptable level. You should use this template to create your strategy. 2.4 Create a risk assessment table including the identified threats and vulnerabilities, the likelihood of their occurrence, the expected impact of the threats on the company’s operations, and the risk rating. You should answer this question based on your answer to question

2.2 and based on the experience that you gained in the basic Cybersecurity unite. The risk analysis matrix should be used in this task.