One of the first aspects to consider when determining vulnerabilities are the vulnerabilities that lie within an organization- internal vulnerabilities. Vulnerability assessments allowed Jacket-X Organization to determine prevalent vulnerabilities within their organization. As observed, there were irregularities within the organizations payroll system. Although Human Resources brought it to the attention to the CIO, there was no documentation of fraudulent activity that occurred.

After reviewing the current implementation of the payroll process of Jack-X Organization, there were a couple of red flags that were brought to my attention:
• Payroll specialists and administrators both have the ability to add employees to payroll directly.
• Payroll specialists can change payroll details during validation.
• There is too much “power” given to specialists.
• Strong possibilities for false time cards to be created.
• Time cards can be modified easily.
• Payrolls that are deleted are not recorded (needed for audit).
• Direct deposit and paycheck generation systems are not linked.
• Reports are easily exported into an Excel file.

These are just some of the vulnerabilities that were noticed. To address these vulnerabilities, the following should be considered:
• Have clear and concise polices as to the extent of permissions given to specialists and administrators. If it pertains to any managerial content, they should not be able to access this content.
• Prohibit payroll details being changed during validation.
• Have some form of authentication that can verify timecards before submission.
• Prohibit specialists from validating payroll data.
• Direct deposit and paycheck generation systems should be linked. There is email notifications sent out only when paychecks are generated. I did not see anything about notification when direct deposit occurs. Therefore, a direct deposit can occur in a bank account and a check generated at the same time.
• Reports should not be allowed to be easily exported with an Excel file. This sensitive information has the capability of being stolen or intercepted into wrong hands. Strong passwords need to be enforced with all reports.

Another important aspect to consider is establishing a secure network. After reviewing the topology within Jacket-X, there appears to be an adequate secure network. There were various components within the network that helped ensure the mainframe and different servers would be protected: Intrusion Detection Prevention Systems and firewalls. While these components are not the only tools used to protect an organization, they can help mitigate vulnerabilities and threats.

After reviewing a security incident that occurred with Vice-President of Sales, Steve Forrester, there is no way to tell for sure when the worm was put on his laptop; there were many incidents when this could have occurred. What polices are in place addressing connecting to LANs? Prior to any device being connected albeit a cellphone, tablet, or a computer, there needs to a policy in place addressing this. Jacket-X is very fortunate to have an IDS in place recognized the threat and alerted Jerry Wilson, ISO. The downtime that was experienced because of lapse in judgment exhibited by Steve Forrester caused Jacket-X to not be able to operate as usual. After analysis of the situation, various measures need to be taken:
• There needs to be a verification process for laptops. They need to be returned so they can be able to be verified before connecting to WAN. These concerns need to be addressed to Steve to make sure he is fully aware of the severity of the current situation.

Audits are not always fun, but they are necessary for any business. Jacket-X will undergo an upcoming audit to determine if the IT controls in place are adequate. Within the audit will fall different aspects-- network security, protocols and services, user security, data storage security, and password security. The following concerns were addressed while preparing for the audit:
• Network activity logging currently in place is not adequate enough. It does not have the capability to keep up with the activity on the network.
• Because firewalls were blocking clients, there were ports that were intentionally being left open for the week.
• Programmers were implementing untested code to the ENTIRE network rendering the network inoperable. Also, activity logging does not record failed login attempts.
• File sharing is conducted at a centralized location.
• Password are not being stored securely

These vulnerabilities can be fixed by—
• Ensuring that activity logging is adequate.
• Do not leave ports open. Attackers can find these open ports and exploit this vulnerability.
• Do not allow untested code to be implemented on an entire network without knowing if it will be a threat; test on smaller sections. Also, all login attempts need to be recorded whether they are successful or failed.
• Conducting file sharing in one location is a recipe for disaster. Because there are a variety of users with different access to information, file sharing should ne occur where all users can access this data. Specified users should have access to certain information.
• Passwords need to be secured. Point. Blank. Period. Storing your password in an unsecure format or location is basically “handing” that information over. Policies need to be in place about password storage and removal.