Quality Web Design
Company Overview

Quality Web Design (QWD) is an organization that specializes in Web site and Web content design for all types of businesses. QWD's mission is to provide top quality Web design that will increase consumer generated revenue to QWD's customer Web sites. QWD's database contains over 250,000 proprietary images and graphical designs that will enhance most Web sites’ appeal to a target demographic.
Hardware Vulnerability

Single ISP controlled router linking service to the internet. There is a security vulnerability to cracking from the internet side of the router, thus possibly severing customers from the product and/or service. Assuming the ISP can control the router remotely, it is a backdoor into the router than can possibly be used by unauthorized users to change the router settings and deny internet service to the company. There is a very low likelihood that the router will be taken over by an unauthorized user. This is also a vulnerability in terms of access control, with no access to an ISP controlled router, Quality Web Design can not secure this router to limit unauthorized access. An edge router should have specific items addressed to ensure that it has as little vulnerability as possible. Here are a few points to consider when securing a router:

• Make sure that the OS is patched and as up to date as possible
• Protocols o use ingress and egress filtering o Screen ICMP traffic from the internal network
• Disable unused ports, and services
• Utilize strong passwords
• Audit Internet facing administration links
• Use static routing to limit an attackers ability to edit routes, and cause a DoS
• Verify that auditing and logging are in place
• Send router logs to a secure central location for storage and future review if necessary
("Securing your network")

Impact on Business Process

Were the ISP router to be compromised the Business processes of Creative Web Design would take a major hit. The company would not be able to provide any of it services to its clients or to the general public. This means that client’s hosted web sites would be down, also meaning that the client would not be able to access their site to make any changes, and the public would not be able to view the pages. Depending on the length of the disruption it is a very distinct possibility that clients will look for services elsewhere in the future. In addition to the client’s pages being down all other access to the Internet from within the company would be down as well, this also means that the company website will be down as well. During the interruption Quality Web Design will not be able to sign up any new customers via the web.
Software Vulnerability

The HP ProCurve Access Points have a software vulnerability that allows users to escalate privileges on the network. This can allow users on the network to gain access to privileged information not meant for their eyes, thus threatening the integrity of the company. Privilege escalation vulnerabilities are not often exploited remotely, but they can present severe damage to the network if combined with someone having managed to gain access to the system. ("Hpsbgn02589 ssrt100296 rev.1," 2010). It is important to manage all points of access to the network including wireless access points. In managing any network device including access points it is important to do the following:
• Use a strong administrator password
• Keep software up to date
• Audit and log allowed and denied traffic
• Restrict access to the WLAN by employing some sort of encryption o WEP (minimum) o WPA
• Restrict access to the WLAN by utilizing mac address filtering
("Securing your wireless")
Impact on Business Process

Should this vulnerability be exploited it could be detrimental to Quality Web Design in several ways including but not limited to unauthorized employees viewing and possibly changing other employees personnel files. There is the possibility of unauthorized employees accessing customer records, and using the information inappropriately, such as the selling of personal information to a 3rd party or other nefarious deeds. This exploit also creates the opportunity for an unauthorized user to corrupt company websites and services. The company’s competitive edge will be affected depending on the amount of damage done before the threat is contained.