...25 miles from the FTF. The Academic and administrative Complex (AAC) is located on the ground of the Maryland Springfield State (Mental) hospital, and hosts approx. 400 patients. AAC has offices and classrooms, computer labs, a food preparation area and dining hall, and shops. Two residential dorms for overnight guests/students, a physical training center and it include offices, classrooms, basketball gym, weight room, and swimming pool. PSETC has 122 staff members, including DTF, FTF, and there is currently no security for PSETC. The hours of operation are 7:30 am to 5:00 pm, Monday through Friday for all facilities and it has about 450 students daily in law enforcement and correctional training programs. 150 guests/students can stay overnight; there is a contractor who prepares food, for them. The record maintenance for all administrative reports for PSETC members, approx. 30,000 personnel. Janitorial services for the PSETC are performed by minimum security inmates from a local correctional institution, and they work under supervision of correctional officers. INTRODUCTION Currently, colleges, universities and training centers are among society’s most vulnerable and exploitable targets for individuals and organizations seeking to cause harm...
Words: 3210 - Pages: 13
...Multi-Layered Security Plan User Domain Risk, Threat, or Vulnerability: Lack of awareness, Apathy toward policies, Security policy violations, Personal CD’s and USB drives with photos, music and videos, Download photos, music and videos, Destruction of systems, applications, or data, Employee blackmail or extortion. Mitigation: Conduct annual security awareness training, Place employee on probation, Disable internal CD drives and USB ports, Enable content filtering. Restrict user access, Track and monitor abnormal employee behavior, Enable Intrusion detection system/Intrusion prevention system (IDS/IPS). Workstation Domain Risk, Threat, or Vulnerability: Unauthorized access to workstation, Unauthorized access to systems, applications, and data, Desktop or Laptop computer operating system software vulnerabilities, Viruses, malicious code or malware infects a workstation or laptop. Mitigation: Enable password protection, Define strict access control policies, standards, procedures and guidelines, Use workstation antivirus and malicious code policies, LAN Domain Risk, Threat, or Vulnerability: Unauthorized access to LAN, Unauthorized access to system, applications, and data, LAN server operating system/application software vulnerabilities, Rogue users on WLANs gain unauthorized access. Mitigation: Define strict access control policies, standards, procedures and guidelines, Make sure wiring closets, data centers, and computer rooms are secure. LAN to WAN Domain Risk, Threat...
Words: 364 - Pages: 2
...Into To security Project Part 1: Multi-Layered Security Plan: As part of my report, below is my outline for Richman Investments Multi-Layered Security Plan: User Domains: Since Users can access systems, applications and data depending on their roles and rights, an employee must conform to the staff manual and policies also known as the Acceptable Use Policy (AUP). The department manager or human resources manager is usually in charge of making sure that employee and in certain cases third party vendors, contractors ect sign and follow the AUP. To ensure that these threats and vulnerabilities can be avoided, a good policy would be to conduct security awareness training, update the employee manual and discuss the handbook, during performance reviews, disable internal CD drives and USB ports and enable automatic antivirus scans for inserted media drives, files, and email attachments, and lastly restrict access for users to only those systems, applications, and data needed to perform their jobs. Workstation Domains: These users configuring hardware, ensuring that all computers have the latest software revisions, security patches, and system configurations. To ensure that there are no threats with our software, enforce defined standards to ensure the integrity of user workstation and data, enable password protections on workstations for access, and auto screen lockout for inactive times, use content filtering and antivirus scanning at Internet, define workstation...
Words: 727 - Pages: 3
...1.0 Overview Standards for network access and authentication are highly required to the company's information security. Any user accessing the company's computer systems has the ability to compromise the security of all users of the network. Appropriate Network Access and Authentication Policy decrees the chances of a security breache by requiring application authentication and access standards across the network in all locations. 2.0 Purpose The purpose of this policy is to illustrate what must be done to ensure that users connecting to the corporate network are authorized users in compliance with company standards, and are given the least amount of access required to perform their job function. 3.0 Scope The scope of this policy includes all users who have access to company provided computers or require access to the corporate network and systems. This policy applies not only to employees, but also to guests, contractors, and anyone requiring access to the corporate network. Public accesses to the company’s externally-reachable systems, such as its corporate website or public web applications, are specifically excluded from this policy. 4.0 Policy 4.1 Account Setup During initial account setup, certain checks must be performed maintain the integrity of the process. The following policies apply to account setup: • Positive ID with Human Resources • Users will be granted least amount of network access required to perform his or her job function...
Words: 937 - Pages: 4
...CSS150 – Introduction to Information Security Phase 5 Individual Project Kenneth A. Crawford Dr. Shawn P. Murray June 23, 2013 Table of Contents Phase 1 Discussion Board 2 3 Phase 1 Individual Project 5 Phase 2 Discussion Board 8 Richmond Investments: Remote Access Policy 8 Phase 2 Individual Project 11 Richmond Investments: LAN-to-WAN, Internet, and Web Surfing Acceptable Use Policy 11 Phase 3 Discussion Board: Blaster Worm 17 Phase 3 Individual Project 19 Phase 4 Individual Project: 4 Methods to Keeping Systems Secure 22 1. Keep all software up to date: 22 2. Surf the web cautiously: 22 3. Be cautious with e-mail: 22 4. Anti-Virus Software: 23 Phase 5 Individual Project: 4 Methods to Keeping Systems Secure 24 1. Firewalls: 24 2. System Backups: 24 3. Passwords: 25 4. File Sharing: 26 References 27 Phase 1 Discussion Board 2 The “Internal Use Only” (IUO) data classification includes all data and information not intended for public access. The best way to describe this classification is all company and client information that we do not want to see in a newspaper or on the internet. Some examples of this are: Client lists, Client account numbers, Human Resource files, Payroll files, E-Mails, and many others. This data classification affects all seven IT domains. The first and most important IT domain that the IUO affects is the “User Domain”. The users have to be taught general security and proper use of the systems they...
Words: 5085 - Pages: 21
...Name 4 Security Tips that the end user can implement. For this week`s task we have been asked to name four security tips that users can do themselves to help protect their computers. The four security tips that I have selected to discuss are; update Windows software, use strong passwords, run a virus scan on a schedule, and update virus definitions daily. Describe the goal of each security tip. Windows update should be run to make sure that your computer has the latest patches. These updates are designed to close security holes that have been found in the operating system and hopefully will help guard your computer from getting infected or hacked. Strong passwords can be very helpful in slowing down or even defeating different attack methods of compromising the user`s computer. Users should think of passwords like a lock on their door, a strong password will make a strong lock. A hacker`s software toolkit will most likely include an offline dictionary, this automated program can quickly identify simple and commonly used passwords. Running a scheduled virus scan should be done by anyone who has a computer. If the user is running AVG for their anti-virus it is pretty easy to set up a scheduled scan. The user can just right click the AVG icon in the system tray, select the tools menu > advanced settings > schedules. From here the user can set the day and time for the schedule to run. It can be set to run a scan once a week or each day. This software scans for any viruses...
Words: 803 - Pages: 4
...The History of wool begins long ago, when primitive man for the first time clothed himself in the woolly skins, of the sheep he killed for food. The sheep could be milked (and still is, in many parts of the world).However man soon understood that to kill the sheep for its meat alone was a waste of food and material. Man had realized when the sheep shed its fur the material could be spun and knitted into cloth. Then he became a shepherd with the help of his friend the dog- probably the only animal to be domesticated before the sheep- he soon developed a system for making clothing from the sheep. Man had found a heavy-duty fabric that would offer him protection from heat, cold, wind, and rain. A flexible cloth that could keep him cool in the heat of the day, also warm in the cold of the night. Man had realized that there is no other cloth that could match wool, there was no other material, natural or man-made, has all its potentials. But man learned he can improve wool by selective breeding of sheep and by combining the wool fabrics with such qualities as shrink resistance, mothproofing, shower-proofing and stain-proofing. Science and technology have kept wool in the lead of fabrics, adjusting to modern-day needs without damaging its virtues. Wool is a very big part of Britain's history, more so than any other product ever manufactured in these islands. It was knitted into cloth here in the Bronze Age which began about 1900 BC. Elsewhere in the world, primitive man had domesticated...
Words: 671 - Pages: 3
...Chapter 3 questions 1. Laws are rules that mandate or prohibit certain behavior. Ethics define socially acceptable behaviors. 2. Civil law comprises a wide variety of laws that govern a nation or state and deal with the relationships and conflicts between organizational entities and people. 3. Criminal, administrative, and constitutional law. 4. National information infrastructure protection act of 1996, modified several sections of the pervious act and increased the penalties for selected crimes. 5. Security and freedom through encryption act of 1997. 6. In this context is not absolute freedom from obeservation, but rather is a more precise "state of being free from us sanctioned intrusion." 7. health insurance portability and accountability act of 1996, requires organizations to use information security mechanisms,a swell as policies and procedures. 8. Gramm-Leach-Bliley Act of 1999; requires due notice to customers, so they can request that their information not be shared with third party organizations. 9. Provides law enforcement agencies with broader latitude in order to combat terrorism-related activities. 10. No electronic theft act 11. IP is the ideas of controls over the tangible or virtual representation of those ideas. It is afforded the same protection in al the countries. The US and Europe contributed The Digital Millennium Copyright Act. 12. Enforces accountability for executives at publicly traded companies. ...
Words: 353 - Pages: 2
...Responses on port 80= a web service is running. HTTP Port 443- HTTPS To run port scans all you need is access to the LAN and/or subnet Technet.microsoft.com/en-us/security/advisory Mitigate vulnerabilities Threats are things you have to respond to effectively. Threats are controllable Risks are manageable Vulnerabilities can be mitigated All affect the CIA triad Not all threats are intentional Confidentiality, integrity, accessibility = CIA Starting on pg 161 DAC- only as secure as the individuals understanding. Access determined by owner. MAC- access determined by data classification itself. data itself has a classification. Need to be cleared to the level of the data security. Also has a “need to know” aspect to it. Non DAC- third party determines the permissions. Role based- pg 166. Access determined on the job of the user. Rule based- variation of DAC. Rules are created and access is based on the rules created. Week of 4/17/13 Starts on pg 146 Project- search SSCP CBK on the library under 24/7 Each of the 7 domains, vulnerabilities in each, security used in each to control, For lab 5--- Make 4 types of connections. 2 secure 2 not secure. telnet, securenet, ssh, and ftp. Will need 3 machines. Student, Target, ubuntu 1 Wireshark setting to capture a file in promiscuous mode on student. Do an FTP to target windows. Command prompt from student to ubuntu. Try to log in. Do questions. Question 9, focus on SSH and what traffic you are getting...
Words: 907 - Pages: 4
...User Domain Risk, Threat, or Vulnerability Lack of user awareness • Conduct security awareness training display security awareness posters, insert reminders in banner greetings, and send e-mail reminders to employees. User apathy toward policies • Conduct annual security awareness training, implement acceptable use policy, update staff manual and handbook, discuss dring performance reviews. Workstation Domain Risk, Threat, or Vulnerability Unauthorized access to workstation • Enable password protection on workstations for access. Enable auto screen lockout for inactive time. Unauthorized access to systems, applications, and data • Define strict access control policies, standards, procedures, and guidelines. Implement a second-level test to verify a user’s right to gain access. Account Policies | Password, lockout, and Kerberos settings. | Local Policies | Audit, user rights, and security options. ("Security Options" consist primarily of security-relevant registry values.) | Event Log | Settings for system, application, security and directory service logs. | Restricted Groups | Policy regarding group membership. | System Services | Startup modes and access control for system services. | Registry | Access control for registry keys. | File System | Access control for folders and files. | LAN Multilayer Security * Coverage considerations for wireless LAN (WLAN) users in a branch office * Distance considerations from the closet to the...
Words: 726 - Pages: 3
...Introduction These past few years have been distinct by several malicious applications that have increasingly targeted online activities. As the number of online activities continues to grow strong, ease of Internet use and increasing use base has perfected the criminal targets. Therefore, attacks on numerous users can be achieved at a single click. The methods utilized in breaching Internet security vary. However, these methods have increasingly become complicated and sophisticated over time. With the increase in threat levels, stronger legislations are being increasingly issued to prevent further attacks. Most of these measures have been aimed at increasing the security of Internet information. Among these methods, the most prominent approach is security authentication and protection. This paper comprehensively evaluates the security authentication process. The paper also introduces security systems that help provide resistance against common attacks. Security Authentication Process Authentication is the process that has increasingly been utilized in verification of the entity or person. Therefore, this is the process utilized in determining whether something or someone is what it is declared to be (LaRoche, 2008). Authentication hence acts as part of numerous online applications. Before accessing an email account, the authentication process is incorporated in identification of the foreign program. Therefore, the most common authentication application is done through incorporation...
Words: 1123 - Pages: 5
...Linda Fernandez Chap 2 Review Questions 1. Why is information security a management problem? What can management do that technology cannot? Both management and IT management are responsible for the protection necessary to secure information. They are the ones who make the decisions regarding the appropriate security system and what level of security will work for the system. 2. Why is data the most important asset an organization possesses? What other assets in the organization require protection? Data is important because it keeps a record of all changes and activity. Without data, the company or organization may fail because they have no records, and therefore be of no good use. 3. Which management groups are responsible for implementing information security to protect the organizations’ ability to function? General Management and IT Management are responsible because it has to be set up for that specific system. If one part fails, then they are the ones to fix it and make it usable 4. Has the implementation of networking technology created more or less risk for businesses that use information technology? Why? Networking has caused more risk for businesses using information technology because it made it much easier for attackers to breach the security systems. They are even more of a target with the internet connection. 5. What is information extortion? Describe how such an attack can cause losses, using an example not found in the text. ...
Words: 1293 - Pages: 6
...ITIL Study Guide | | | | ITILFND01 Service Management as a practice The purpose of this unit is to help the candidate to define Service and to comprehend and explain the concept of Service Management as a practice. 01-1. Describe the concept of Good Practice (SS 1.2.2) 01-2. Define and explain the concept of a Service (SS 2.2.1) 01-3. Define and explain the concept of Service Management (SS 2.1) 01-4. Functions and Processes (SS 2.3, 2.6.1, SD 2.3, SD 3.6.4, ST 2.3, SO 2.3, 3.1, CSI 2.3) 01-5. Explain the process model and the characteristics of processes (SD 2.3.2, 3.6.4) The recommended study period for this unit is minimum 45 minutes ITILFND02 The Service Lifecycle The purpose of this unit is to help the candidate to understand the value of the Service Lifecycle, how the processes integrate with each other, throughout the Lifecycle and explain the objectives and business value for each phase in the Lifecycle 02-2. Structure, scope, components and interfaces of the Service Lifecycle (SS 1.2.3 All ) 02-3. Account for the main goals and objectives of Service Strategy (SS 1.3) 02-4. Account for the main goals and objectives of Service Design (SD 2.4.1, SD 3.1) 02-5. Briefly explain what value Service Design provides to the business (SD 2.4.3) 02-6. Account for the main goals and objectives of Service Transition (ST 2.4.1) 02-7. Briefly explain what value Service Transition provides to the business (ST 2.4.3) 02-8. Account for the main goals and...
Words: 1961 - Pages: 8
...Student Name: Philip J. McCarthy UNIVERSITY OF PHOENIX IT/244 INTRO TO IT SECURITY Instructor’s Name: JAMES SERSHEN Date: 04/18/2012 1. Introduction Due in Week One: Give an overview of the company and the security goals to be achieved. 1.1. Company overview As relates to your selected scenario, give a brief 100- to 200-word overview of the company. The Company I have chosen is, The Bloom Design Group. The Bloom Design Groups mission is to provide online interior design services to its customers. The company offers their customers interior design services. What sets this company apart from others is that they have a website that allows customers a chance to design and decorate their rooms to their liking in a virtual environment before spending their money. The option provided for their customers is a virtual decorating tool. With this tool customers can play around with various color schemes for each room’s floor and ceilings, as well as customizing furniture as well. Then employees are able to access the corporate network through a VPN collection to access their client files, in order to place electronic orders for the design materials and furniture. 1.2. Security policy overview Of the different types of security policies—program-level, program-framework, Issue-specific, and system-specific—briefly cover which type is appropriate to your selected business scenario and why. Program-Framework security policy is the best overall for this type of company. As The Bloom...
Words: 924 - Pages: 4
...Intro Intro Swot BalancedScorecard Conclusion Corporate finance 2 Ngoc-Viet Vo Binh-Duong Doan Yuming Hao Huili Liu Noelia Martin Plaza Khurram Shahzad © 2010 - GMP IAE LYON 3 Intro Intro Swot BalancedScorecard Conclusion Plan Intro Swot Scorecard Conclusion Plus Introduction SWOT Analysis Balanced Scorecard Strategies & Indicators GMP Corporate Finance Plus Conclusion 2 Intro Intro Swot BalancedScorecard Conclusion introduction 3 Intro Intro Swot BalancedScorecard Conclusion Introduction Intro Swot Scorecard Conclusion Plus GMP Corporate Finance Plus Google is a global technology leader focused on improving the ways people connect with information. Incorporated in California in September 1998 and reincorporated in Delaware in August 2003. Headquarters are located at 1600 Amphitheatre Parkway, Mountain View, California 94043 4 Intro Intro Swot BalancedScorecard Conclusion Introduction Intro Swot Scorecard Conclusion Plus Mission: Google’s mission is to organize the world’s information and make it universally accessible and useful GMP Corporate Finance Plus Major Products: Google Web Search with Advanced Search Functionality Web Page Translation—supports 41 languages Integrated Tools—such as a spell checker, a calculator, a dictionary and currency and measurement converters Google image and book search Google Scholar Google Finance Google webmaster...
Words: 1119 - Pages: 5
