Title: Exam 1
Course: KVCC BUS214 > Section: Assessments

Module 1

In the first module, we introduce the concepts of security and discuss how they influence an organization. The following questions are on the topics covered in this first module.

a.      The first thing that Testout attempts to do is make the argument that security is important. As per this discussion, they present the three reasons below. What I would like you to do is give a scenario/example that explains each item. These scenarios could be things that you experienced at work or elsewhere and research can be conducted to find examples.

i.           Sophistication of attacks

ii.           Proliferation of attack software

iii.           Scale and velocity of attacks

b.      In each of three examples you provided below I would like you to connect them to the CIA triad and explain which if not all of the arms that are present in that attack with details on how they connect.

c.      If we accept that security is a concern in the modern business environment then we need to start examining what we have for potential dangers. Testout classifies these as being threats, vulnerability, and exploits. What I would like you to do is examine a workplace and provide an example. You did this in a previous assignment so this could be used again here and it will be built on further in the next question.

i.     Who would be the threat agent that could carry out this threat?

d.      Now that you have developed a scenario that goes into a potential threat, we need to look at ways that this threat or vulnerability can be compromised. Testout describes a few strategies that are possible to compromise a system. To understand each I would like you to describe how they could be used in a possible compromise. Relate this to a scenario you developed above.

i.     Strategies

1.      Reconnaissance

2.      Breach

3.      Escalate Privileges

4.      Stage

5.      Exploit

ii.     Which of the above do you consider the biggest threat for this organization? Why?

iii.     Which is the least? Why?

e.      If we know what we have for threats then the next step is to develop ways to mitigate them. Testout again provide you some options when it comes to this. I would like you to relate each to the example we have been working on in the previous questions and state how they would protect you from the items in the previous question.

i.           Categories

2.      Layer

3.      Principle of Least Privilege

4.      Variety

5.      Randomness

6.      Simplicity

ii.     Which of the above to you thing is the most effective approach? Why?

iii.     Which do you think is the least effective? Why?

Module 2

Module 2 is on access controls. We have begun the exploration of security threats and one of the best methods is to limit access in some way. The following questions are on this topic

a.      The discovery on access control starts with an examination of the various models. These are listed below. What I want you to do is come up with a very brief one sentence maximum description of each and then come up with at least one advantage and disadvantage for each.

1.      MAC

2.      DAC

3.      RBAC

4.      RSBAC

5.      Federated Access Control

b.      How do these relate to the CIA triad?

c.      Which would you adopt if it were your choice within an organization? Why?

d.      What is the difference between Identification and Authentication?

e.      There are five types of authentication levels. I want you to select a business and explain how each could be implemented within, giving examples.

f.       Which security type do you believe would be the most beneficial to that organization? why?

1.      As with most things, the more you add in terms of protections the better you will be in the long run. How would you overlay these protections to ensure a higher level of security? Provide an example.

g.      Testout continues this discussion further and lists a few best practices in terms of how to implement access controls within an organization. As with the above cases, I want you to provide a scenario on how each relates to the workplace you have been examining in the previous questions.

i.     Principle of least privilege

a.      Need to know

b.      Separation of duties

c.      Job Rotation

h.      By doing the third assignment you were able to explore the Windows and Linux options when it comes to user access control so we will not explore these options further. I however want you to start thinking about how to apply some of these strategies and overall how you will harden the levels of user accounts you have. To this aim you are going to develop a policy that should cover the following topics:

1.      Account Lockout

a.      When

b.      How long

c.      How does it get reset

2.   Account Restrictions

a.      Hours

b.      Specific computers

c.      Expiration

d.      Disabling

3.   Password policies

a.      Length

b.      Age

c.      Complexity

4.   Organization

a.      How they accounts will be structured within the system you use (such as grouped by OU)

5.   Oversight

a.      Who has access to make changes

b.      How do these changes get documented

6.   Training

a.      How will you ensure that the staff has a good security attitude?

b.      What kind of trainings will occur and when?

Module 3

Module 3 is about cryptography. We have not completed the entire section yet however I want you to start thinking about how you can use this topic within your current or future workplace.

1.      Select and list a business that you can analyze in regards to the information they store ( it is recommended this is the same business that you have been using or will use in your project)

2.      What kind of information does this business store?

3.      Do they currently use encryption?

a.      If yes, describe what they use, being as specific as possible.

e.      What could they improve on?

b.      If the answer is no, what areas should they be using encryption in?

c.      Does this encryption have a benefit to this organization?  Defend your answer

1.      Either way if they use encryption or not I would like you to research and select an algorithm:

2.      Summarize the algorithm describing it such as how many bits and so on

1.      Why did you select this particular one?

2.      How would this benefit the business

3.      How could this business use hashing to ensure integrity? Provide an example.

4.      Now I would like you to examine your personal information.

5.      Do you use encryption? Why/Why not

1.      Do you think there is a benefit for you to do so? Why/Why not

2.      Research an algorithm or solution that would benefit your needs (do this even if you said you do not require encryption because by finding an option you might change your mind)

6.      Overall how important do you consider encryption? I want you to find an article online that illustrates your point. You might think this research would be one sided however you should be able to find both sides of the argument online.

Attached Files: | - KVCC BUS214_InfoSystemsSecurity_Asessment 1.pdf