Introduction
Bank SolutionsInc. is in need of a tailored IT security plan for strategic advantage, regulatory compliance, and risk mitigation. As an organization that relies on IT for innovation and technical advantage, it is essential to invest in necessary security controls. This will ensure the infrastructure supports a layered security posture to detect, deter, eliminate or reduce as many vulnerabilities and exposure as possible. It is the responsibility of executive management to determine the amount of exposure and risk their organization is willing to accept.
Objectives
The main objectives of this security plan are to describe a security strategy and identify recommended technologies to ensure Bank Solutions has the ability to achieve their objective and ensure that the mission and goals of the organization are positively impacted.
Security Strategy
Our security strategy is a methodology for defining security policies and necessary controls. This includes the assessment of all possible types of risk i.e.: Malicious hacker; also the prediction of different types of attack for example, logic bombs and viruses. This plan includes a proactive and reactive strategy to protect the confidentiality, integrity, and availability of our organizations information and data.
The proactive strategy is to predict the possible damage, determine all vulnerabilities then implement plans, develop security policies and controls to best minimize those vulnerabilities. The reactive strategy is to assess damage and determine the possible causes, and afterwards implement and develop security policies and controls to repair the damage. Lastly, implement a plan of contingency to prevent further occurrence. The annual review of these plans and po...
... middle of paper ...
...itepapers/threats/vulnerabilities-vulnerability-scanning-1195
Kinn, D., & Timm, K. (2002, July 18). Justifying the Expense of IDS, Part One: An Overview of ROIs for IDS | Symantec Connect Community. Retrieved from http://www.symantec.com/connect/articles/justifying-expense-ids-part-one-overview-rois-ids
References (cont.)
Mortazavi, S.H. & Avadhani, P.S. (2013). RSA cryptography algorithm: An impressive tool in decreasing intrusion detection system vulnerabilities in network security. International Journal of Innovative Technology and Exploring Engineering, (4), 306. Retrieved from: http://www.ijitee.org/attachments/File/v2i4/D0527032413.pdf
SANS Institute, (2001). Understanding intrusion detection systems. SANS Institute InfoSec Reading Room. Retrieved from: https://www.sans.org/reading-room/whitepapers/detection/understanding-intrusion-detection-systems-337
IDS is a device or software application that monitors a network for an unauthorised attack.
PKC is the enabling technology for all Internet security and the increasing use of digital signatures, which are replacing traditional signatures in many contexts. However, RSA is better than PKC because RSA doesn’t need digital signature. As a result, the RSA algorithm turned out to be a perfect fit for the implementation of a practical public security system. In 1977, Martin Gardner first introduced the RSA system. After 5 years, company RSA used secure electronic security products. Nowadays many credit companies of all over the world use the RSA system or a similar system based on the RSA system.
These warnings can help users alter their installation’s defensive posture to increase resistance to future attacks. An intrusion detection system is comparable to a burglar alarm system. The car locks to protect the vehicle from theft. In the event someone compromises the lock, the burglar alarm detects this compromise and alarms the owner.
The Aim Higher College’s system administrators and network engineers have described seeing some strange behaviors such as high levels of traffic from many hosts that are causing system outages. The web servers of the college have been shutting down frequently by this traffic, it must be from a hacker group trying to attack the school with malicious software. I will review the network traffic from the college’s intrusion detection system and use an intrusion prevention system to block off these threats from the hackers.
Security helps the organization meet its business objectives or mission by protecting its physical and financial resources, reputation, legal position, employees, and other tangible and intangible assets through the selection and application of appropriate safeguards. Businesses should establish roles and responsibilities of all personnel and staff members. However, a Chief Information Officer should be appointed to direct an organization’s day to day management of information assets. Supporting roles are performed by the service providers and include systems operations, whose personnel design and operate the computer systems. Each team member must be held accountable in ensuring all of the rules and policies are being followed, as well as, understanding their roles, responsibilities and functions. Organizations information processing systems are vulnerable to many threats that can inflict various types of damage that can result in significant losses (Harris, 2014). Losses can come from actions from trusted employees that defraud the system, outside hackers, or from careless data entry. The major threat to information protection is error and omissions that data entry personnel, users, system operators and programmers make. To better protect business information resources, organizations should conduct a risk analysis to see what
The National Strategy is a plan to help prevent the disruptive of a terrorist attack and to protect the people of America from any damage that done was done during the attack, and help respond to any incident that does occur and also help the country recover quickly. The National Strategy was a plan that was developed by the White House Office of Homeland Security to help protect the American people safety. The National Strategy focuses more on providing guidance and organizes the efforts of agencies within the federal government that play a role in the National Homeland Security. The National Strategy also set goals to meet to reassure the safety of America by implementing policy and agendas with the responsibility to fulfilled in order to
In 1980, James Anderson’s paper, Computer Security Threat Monitoring and Surveillance, bore the notion of intrusion detection. Through government funding and serious corporate interest allowed for intrusion detection systems(IDS) to develope into their current state. So what exactly is IDS? An IDS is used to detect malicious network traffic and computer usage through attack signatures. The IDS watches for attacks not only from incoming internet traffic but also for attacks that originate in the system. When a potential attack is detected the IDS logs the information and sends an alert to the console. How the alert is detected and handled at is dependent on the type of IDS in place. Through this paper we will discuss the different types of IDS and how they detect and handle the alerts, the difference between a passive and a reactive system and some general IDS intrusion invasion techniques.
Summary Report for: Computer Security. (2010). January 10, 2011, from O*net Online: retreived January/15/2011 http://online.onetcenter.org/link/summary/15-1071.01
Whitman, M., & Mattord, H. (2010). Management of information security. (3rd ed., p. 6). Boston, MA: Cengage Learning.
Due to their complexity and importance to information security, two security systems, Network Intrusion Detection/Prevention Systems (NIDPS) and Security Information and Event Management systems (SIEM), will be explored in this paper. Both have multiple functionalities, including threat-detecting capabilities, and are widely considered essential tools for adequate network defense, particularly in the goal of fortifying valuable assets in the face of an advanced threat. Understanding these systems is vital for any security operation tasked with defending significant networks.
Principle of Security Management by Brian R. Johnson, Published by Prentice-Hall copyright 2005 by Pearson Education, Inc.
In fact, according to several studies, more than half of all network attacks are committed internally. To determine the best ways to protect against attacks, we should understand the many types of attacks that can be instigated and the damage that these attacks can cause to data. The most common types of attacks include Denial of Service (DoS), password, and root access attacks.... ... middle of paper ... ...
Implement physical security: - “Physical security protects people, data, equipment, systems, facilities and company assets” (Harris,
The network management plan and security plan is important to help the company figure out how they will improve its network and security procedures for the company. Planning involves outlining objectiv...
The first thing that we must consider about Information Security is that there is not a final destination at which we can arrive. IT Security is an ongoing set of processes and activities that requires attention and expertise on a daily basis. It is important to understand that systems are not secured by themselves and it is our responsibility to maintain and improve them periodically as required. It is of vital importance to establish the appropriate mechanisms and requirements in order to support the company’s CIA triad. The following report will provide you guidance about auditing and hardening techniques applied though the 7 Domains by utilizing IT Security Best Practices.