Introduction:
In managing risks in an organization, professionals in the information technology (IT) department conduct research to identify threats, vulnerabilities, and threat/vulnerability pairs. Then, the IT professionals determine the likelihood of each threat occurring. The IT professionals present this information to IT management, whose role in risk management is to determine and recommend approaches to manage these risks. IT management then presents these recommendations to the senior management, whose role is to allocate resources, specifically money and employees, to prepare for and respond to identified threats and vulnerabilities appropriately.

This activity allows a small group of students among you to fulfill the role of IT professionals in a small business tasked with identifying threats, vulnerabilities, and threat/vulnerability pairs; estimating the likelihood of these threats occurring; and present this information to IT management.

Scenario:
YieldMore is a small agricultural company, which produces and sells fertilizer products. The company headquarters is in a small town in Indiana. Outside its headquarters, there are two large production facilities—one in Nebraska and other in Oklahoma. Furthermore, YieldMore employs salespersons in every state in the U.S. to serve its customers locally.

The company has three servers located at its headquarters—Active Directory server, a Linux application server, and an Oracle database server. The application server hosts YieldMore’s primary software application, which is a proprietary program managing inventory, sales, supply-chain, and customer information. The database server manages all data stored locally with direct attached storage.

All three major sites use Ethernet cabled local area networks (LANs) to connect the users Windows 7 workstations via industry standard managed switches.

The remote