About Organization:
ABC Inc. is a leading telecom provider with a customer base of over million of users. It provides all the telephone and internet services to its customers.

Management Controls

Risk Management
ABC Inc. is ready with the disaster recovery technique, so the risks can be handled in the organization with care and proper management; they are also maintaining a risk assessment report.
Review of Security Controls
They have documented the security plan for the organization and they keep on reviewing and improving the same.
Lifecycle
It deals with the configuration management system implemented in the company. On every Wednesday, the management plans a meeting for a change request. All the things regarding the change is discussed in the meeting, like why the change is required, what would be its benefits & is their any risk to execute them in the system, etc. The company has a separate development and pre-production environments set-up, so whenever any change is required in the system, the changes are done on Development environment, if it is successful, the same is replicated in pre-production environment. After the successful implementation in dev. and pre-prod environments the changes are done in the production system. But before implementing any changes in production environment, you need an approval from the same from the CMS Team, and this approval is taken in the change management meeting.
Certification and Accreditation
Company is following all the certification and accreditation and they have documented the same.
System Security Plan
ABC Inc. has deployed https protocol; they are following other security measures as well and have documented the same too.

Operational Controls

6. Personnel Security
The users are not trained on the security of the system; they have not taken any security awareness training. They have read the rules of behavior for the system but they are not following it practically. Users who have direct access to the system have not gone for any background investigations.There are no clearly defined duties between programmers and administrators.
7. Physical Security
The Physical security is being provided to the system by manpower and by using access restricted zones in the organization. The system is also prepared for any disaster recovery by using disaster recovery management.
8. Production, Input/Output Controls
The input for the production is the responsibility of only the authorized users. The data is sensitive and it can be retrieved after its disposal. The company has not as such implemented any controls for data disposal.
9. Contingency Planning
The company takes back-up after each month’s end.The system can be restored using OIM.Restoration of the system can take few minutes to an hour.Back-up procedures have been tested successfully.
10. HW/SW Maintenance
The HW/SW is maintained using oracle guidelines. All the required security patches have been implemented in the system.
11. Data Integrity
There are no measures to control the virus attack which may result into a lot of hazards.
12. Documentation
The company is following proper documentation. It has documented the security plan, risk evaluation & assessment report, etc.
13. Security Awareness and Training
The security awareness training has been provided only to limited number of employees, these employees are part of the upper-management. Rest of the employees does not know much about the security training.
14. Incident Response
If an incident occurs in the company, the reporter reports to the IT Helpdesk guys at the toll-free numbers and then they route the call to the concerned employee and then the action is taken. The logs are maintained for all this purpose.

Technical Controls
15. Identification and Authentication
ABC Inc. is following user and access management based on Oracle Identity Manager (OIM) and Oracle Access Manager (OAM). Every user is assigned with a unique user-id and password so that they can manage their unique identity in the organization so that the system can authenticate the valid user.
16. Logical Access Controls
Their access is defined on the role they have in the organization so they are following the logical access control by using the access policies created in the Oracle Access Manager. So a Manager is having different resource access as compared to his subordinates. Session Control: There is a time-line of 10 minutes for session expiration, it means if a user is inactive from past 10 minutes, his session will be expired. This policy has been implemented using OAM. A user can have various concurrent session logins from various machines which is a big flaw in the system which should be taken care by the organization.
17. Audit Trails
The Audit trails are done at the end of every quarter.

Analysis ABC Inc. is successfully following most of the management, operational and technical controls but it has to work on the loopholes analyzed in the system, because these loopholes can create hazards in the system. The company is following identity and access management platform supported by oracle identity and access manager. The user identities are also stored effectively in Active-Directory. It is good in managing the change configuration system for its up gradation. Various environments have been set for deploying and testing purpose. Audit trails are regularly followed. So, basically ABC Inc is doing well from the Technical controls view. There are some issues in Operational controls, like the employees are not very well aware regarding the security of the system. Proper training must be provided to the individual, this is necessary for the security of the system. There are no measures for virus protection which can create havoc in the system. But it is good in maintaining contingency planning and incident reporting. Company is following a proper lifecycle. There is a well-defined hierarchy to take the necessary approvals and all.

Action-Plan

• The first and the most important step is to implement measures to protect the system from virus attacks. • Provide security training for all the employees. • Implement some data disposal techniques in the system. • Maintain logs for all the major and minor transactions in the system.